Isn't it possible to disable autorun, or did this disappear with Windows 7?
If it is still there, don't you just disable it, and scan with whatever scanner you have?
Surely there must be a setting somewhere to ensure that a USB can't be plugged in by a sociopath and automatically infect a library system.
I came across a tool "USB Vaccin" which not only stops the autorun and the spreading of the infection, but also prevents your thumb drive from getting some very common infections while using it at work or on a friend's computer: It creates a set of hidden, read-only folders with the following name scheme : malware_name.extension.
Among the created folders :
Autorun.exe
Adobe.exe
Adober.exe
svchost.exe ....
To distinguish these legitimate folders from actual malwares; hover the mouse and a the description popup will show you that they all contain the same text file (a description file).
Scanning a vaccin-ed drive will report as clean, the software itself (USB Vaccin) is being detected (falsely) as some sort of trojan dropper.
If the moderators agree, I'll post it here as a zip archive
Source : Infections par supports amovibles - Forums Zebulon.fr (French forum, use google translate)
Until the introduction of Windows XP, the terms AutoRun and AutoPlay were used interchangeably, developers often using the former term and end users the latter. This tendency is reflected in Windows Policy settings named AutoPlay that change Windows Registry entries named AutoRun, and in the autorun.inf file which causes "AutoPlay" to be added to drives’ context menus. The terminology was of little importance until the arrival of Windows XP and its addition of a new feature to assist users in selecting appropriate actions when new media and devices were detected. This new feature was called AutoPlay and a differentiation between the two terms was created.[1]Just use the Panda USB Anti-Virus tool and it'll do everything for you.AutoPlay is a feature introduced in Windows XP which examines removable media and devices and, based on content such as pictures, music or video files, launches an appropriate application to play or display the content.[1] If available, settings in an autorun.inf file can add to the options presented to the user.
Thanks for the Panda USB Vaccine, it worked great. I had heard of this software but didn't realise it could be so useful!
I was a bit worried at first though as the vaccine disabled autorun, but when I connected the USB flash, the 'AutoPlay' pop-up appeared asking me what to do. This must be different to the 'AutoRun'? Anyway I used Avast 5 free to scan the flash and indeed there two worms in there! The threat level was classed as 'High'. Avast just wiped them out with ease as usual. This new version 5 is a great antivirus!
May I suggest that you scan this stick with some more scanners. As good as Avast may be, it could have missed some. Superantispyware and Malwarebytes come to mind. And if you want to be really thorough, send the files here: VirusTotal - Free Online Virus and Malware ScanThanks for the Panda USB Vaccine, it worked great. I had heard of this software but didn't realise it could be so useful!
I was a bit worried at first though as the vaccine disabled autorun, but when I connected the USB flash, the 'AutoPlay' pop-up appeared asking me what to do. This must be different to the 'AutoRun'? Anyway I used Avast 5 free to scan the flash and indeed there two worms in there! The threat level was classed as 'High'. Avast just wiped them out with ease as usual. This new version 5 is a great antivirus!
Quote