Is Your Flash Drive Infected?

Flash Drives, Viruses, and AutoRun

Malware authors find it easy and profitable to write malware designed to be spread via flash drives. There are a couple of reasons why flash drives make good vectors for malware. First, flash drives are "promiscuous" (in a metaphorical sense) because a given flash drive is inserted into a number of different devices on a routine basis. The lost Australian flash drives were sold after being unclaimed, and made the rounds as the unsuspecting purchasers began using them. Second, the AutoRun feature in Windows is ideal for spreading malware via flash drives.

Here is how AutoRun works: when a removable storage device, such as a flash drive, is connected to a Windows computer, Windows checks it for the presence of a configuration file named AUTORUN.INF. If that file is found, the instructions in it are executed. AUTORUN.INF tells Windows to run a program automatically when the storage device is connected to the computer. AutoRun is a convenience; it enables movies, music, games, or setup programs to start up as soon as you insert a CD or flash drive. But AutoRun can also enable malware to execute without your knowledge.

A malware program can be designed to detect the connection of a removable storage device, copy itself to that device, and create or modify an AUTORUN.INF file that runs the malware whenever the device is connected to a new computer. So even if you practice safe computing, your flash drive could be infected with a virus simply by inserting it in a friend's computer. And unlike movies that start playing or setup utilities that display a startup screen, AutoRun malware does not give the user any sign that it is present or running. A lot of malware is written to take advantage of AutoRun. Just plug the flash drive into your USB port, and you're infected, unless you've taken precautionary measures.

Protection From Infected Flash Drives

Many people fail to scan flash drives for viruses, which is another reason why malware authors love flash drives. Check the settings of your anti-malware program to make sure that it scans removable media automatically, every time such media is connected to your computer.

You can disable AutoRun to help prevent execution of malware from flash drives. The Microsoft method is somewhat complex and involves tinkering with the Windows registry. Anti-malware developer Panda Security offers an easy to use, free tool that will "vaccinate" your computer (and optionally your USB drives) against AutoRun malware. The Panda Research USB Vaccine can provide two forms of protection. Vaccinating your computer will disable AutoRun for all removable media. No program on a flash drive, CD, DVD, Blu-Ray disc, etc., will be able to auto-execute.

That's the most comprehensive protection, but it makes life a bit inconvenient, because movies, music, and software installers will not automatically open when you pop in a disc. As an alternative, you can vaccinate only USB flash drives. The Panda "Computer Vaccination" feature doesn't change anything on the discs or flash drives that are currently mounted. It only changes the Windows AutoRun setting. Be aware that if you have a Magic Jack, and use the "USB Vaccination" feature, you should unplug your Magic Jack first, or it could be damaged.

It should be noted that malware can still be copied to and from a vaccinated flash drive. But it will not auto-execute. The best protection is to make sure your anti-virus protection will automatically scan all removable media (flash drives, CDs, DVDs) when they are inserted. If you don't have a good anti-virus program, or you're considering a switch, see my article on Free Anti-Virus Programs for some advice.

Have you been bitten by an infected flash drive? Post your comment or question below...