Free Essay

Thumbdrive, Pendrive, Flashdrive or Whatever You Call It: Pendrive Virus

In:

Submitted By funtikar
Words 507
Pages 3
We all know that any type of USB Mass Storage Device is susceptible to a virus infection. Yes we do have Antivirus,you have [Insert your best bet AV name],but at some time the virus can and will bypass the security measure that have been placed by our security system software. We also have to remember that the av's rely heavily on its database signature of virus. This means if your system is to be infected by a newly crafted virus ,chances are your av won't detect it at all eventhough its equipped with a highly advanced heuristic scanner. Enough with the bull. What i'm really trying to say is how dangerous it is for us to double click/"Open" your pendrive's drive in "My Computer" right after you plugged in your USB storage device. When you double click or "Open" ,you are actually trying to launch the virus itself embedded in the USB storage device or more specifically you are actually excuting the program stated in the file named autorun.inf.example of the content of the autorun.inf file: [autorun] open=yxcm.exe This is the only way a virus can move,run or to be excecuted. So this method of propagation highly depends if the host has the following.. etc weak av,unupdated av,computer illiterate user. We can safely say that every infected USB storage device have both autorun.inf and atleast an executable. Usually these two files are extra hidden and can only be seen using the Command Prompt. To see the hidden files using the command prompt. Launch the command prompt by clicking the Start button and in the text box type "cmd" and press enter(without the quotes). From there type the letter of your pendrive (assuming that you have already plugged in your pendrive) then colon (stacked full-stop sign) proceed by pressing enter , for example
F:

it should now display F:\> now you are at the root. to see the hidden files type
DIR /AH This will list all the files that are extra hidden. In our case(an infected pendrive) would usually show something like this 05/29/2011 08:00 PM 250,048 autorun.inf
07/16/2011 11:29 AM 763,776 yxcm.exe to delete these files you have to unhide them first. Which you can do by typing the command :
ATTRIB -S -H filename.ext for example the file yxcm.exe you would type
ATTRIB -S -H yxcm.exe its that simple. ATTRIB actually stands for attribute the sign (-) means to disable ,to enable use (+),S stands for System flag,H stands for Hidden flag,and at the end of it is the parameter or the file name and its extension. after you have done this then you can delete them. to delete them you can use the command DEL.
The syntax is DEL [file name] in our case DEL yxcm.exe and DEL autorun.inf
There are plenty of other commands that i havent show yet but this is the end

Similar Documents