billermo

In my office, we have one shared computer that is often getting infected via thumb drive/memory stick/USB. Basically, different people come in and plug in their thumb drive, and the infection spreads to the computer as soon as it's plugged in. On this machine we have AVG Free at the moment. It's not stopping this from happening.

These days, is there some special software or tool that can be used so that these thumb drives can be safe to use?

Putting anything ON these thumb drives is impossible since people I don't even know have access to this computer. It would need to be something that's resident on the computer itself. ANd also something that will block virus infection in all cases -- basically that doesn't offer up a YES / NO choice for this thumb drive user so that they can mindlessly quickly click to choose to allow the virus to infect the computer. Some of the people using it, for example, don't speak English, so wouldn't even know what buttons they're clicking or what any of it means.

Basically, is there any dummy-proof mode of protection in this area?

lorjack

Do they need to have flash drives? I would just disable the USB that way they couldn't plug anything into one of my systems, especially if they are infecting it.

billermo

I'm considering that. No they don't need to use the flash drives. They could email their documents to their yahoo or gmail accounts and download them. Much safer.

I was just trying to see if anyone here knew of any totally secure way protect against flashdrive-borne viruses. I've looked and can't find something that would work.

It just hit me, if they really wanted to plug in, they would plug it into one of the USB ports on back of the computer.

lorjack

Yeah, if you do it through email it should be scanned by the AV.
here is a link for disabling USB if you decide to do it.

http://support.microsoft.com/kb/823732

billermo

So this will work to prevent any USB's from 'installing', the article seems to say. But would anything prevent the user from going into Windows Explorer and just opening it up that way?

lorjack

It doesn't prevent them from physically plugging in the device, but when they do it will not install and therefore they cannot use it. They cannot use windows explorer to access it if it isn't installed.

You know when you plug in a drive in and it pops up saying that it is installing the device. It will not do that.

billermo

OK excellent. That should work then. Much better than having a go at the USB plug with a pair of pliers. ;)

snemelk

You may also want to read these articles:

http://nick.brown.free.fr/blog/2007/10/memory-stick-worms
http://www.us-cert.gov/cas/techalerts/TA09-020A.html

Panda USB and AutoRun Vaccine

When autorun is disabled, you can still use USB devices...

billermo

Is there an UN-fix for this Microsoft database solution?

I'm looking at the ones below now, , posted by snemelk, the Panda one in particular, and thinking something a bit less severe might be better.

billermo

Thanks very much. The Panda solution looks especially good -- still allows these people to use their flash drives but drastically reduces the risk of infection when they do it.

lorjack

Just reverse the steps and undo the changes you made.

Disabling autorun, will only disable that feature. If they try running an infected program or document off of that flash drive you will still be infected.

billermo

Hi, Lorjack,
OK my manager has asked me to undo the USB disabling because some people need to use it, but when I followed the directions on the Microsoft page you sent me to turn off the USB, I chose the option to use the Fix It button -- so it was all done under the hood without my seeing the changes that were made. There are steps described below that Fix it button on the MS page which appear to be to be instructions of how to do the same thing manually. The problem is that they describe changing a hex value in the registry as the key step, and it mentions changing it to 4 but it doesn't mention what that hex value was originally. So I'm stuck, not knowing how to reverse the steps, there's not enough detailed information in the steps to undo them. Any ideas?

thanks,
Bill

lorjack

The default value is 3.

billermo

OK I've done it. Thanks much for such a quick reply.

billermo

It worked. USB can be used now, but autorun is disabled (by Combofix, I'm told, but also by Panda's tool, just in case), which is what I want. That should drastically reduce the opportunity for infection.

Hopefully this will hold.