Saturday, January 10, 2009

Defending Viruses that spreads from usb drives

Well all of us have the problem of viruses if we use Microsoft versions of operating systems. Most often the usb drive becomes a virus truck. The moment we plug our pen drive to a windows machine it is Automatically mounted and played. This is configured using the autorun.inf file. This file consists of the cell scripts to execute when the USB is mounted via the windows based operating systems.

Now what the viruses do is when it write itself to the USB disk it

also edits the Autorun.inf with a command to execute itself on the time of mount.

such edited file is shown below


Here the system.exe is a virus. So how can we get through with this. The way Im going to tell you is by disabling the autorun feature of the Operating system. Well this is not an exact cure but is will hold on as it wont execute any files in a USB or a Media drive (CD VCD).

Once this is done you want see the Selection menu that pops in when you plug the pan drive or a CD. But this is easy than removing viruses.

So this is how to disable this feature.

We do this using the Group Policy editor. Like many other management consoles, the GPE is not listed in Start-All Programs. To open it, go to Start-Run and enter "gpedit.msc" (without quotes). Figure 1 shows one view of the console.

figure 1 

So once this dialogue appears go to the Computer configeration and click on the Administrative Templates. A tree list will be opened. Click on the system folder and you will see a set of files open on the settings. Scroll it down till you find the Turn off AutoPlay.

once clicked on the Turn off Auto Play you will get this type of dialogue. Click on the disables radio button. And press ok. So we are done

So as we are done now windows have the autorun feature disabled. This will partaily protect you form the viruses that comes within the USB

The tradeoff we are facing here is that the DVD and Audio CDS wont autoplay. You will have to manually autoplay them using a media player or by write clicking the disk. 

Well You wont have these problems if you move to UBUNTU

1 comment:

zombies! zombies! ZOMBIES! said...

Very interesting! I'm defiantly following you're blog!