Click here to Skip to main content
65,938 articles
CodeProject is changing. Read more.
Articles / USB

Preventing viruses from entering a USB drive in Windows

5.00/5 (14 votes)
22 Oct 2012CPOL3 min read 60.9K  
Preventing viruses in a USB drive in Windows

Almost everyone who owns a USB drive has sometime formatted his drive because of the virus that gets transmitted through USB. In this tip/trick I will tell you how to prevent viruses from entering your USB.

I know most people would say "that can be easily done by disabling autorun of USB in the computer" . Some programs allow you to set your USB as read-only. It can be done by messing with registry (there are a lot of articles on the internet explaining that). Some USBs have a Write-lock mechanism available like SanDisk . Also there are programs like Panda USB vaccine which disallow permission to modify or open Autorun.inf file. What I am about to tell you can easily do without downloading any program.

Most common places where viruses hide themselves in the USB are RECYLER folder,MSOCACHE folder, and by executing through Autorun.inf file. To disallow Autorun.inf file being created in USB, Create a folder and rename it as Autorun.inf. Add any new file within the "Autorun.inf" folder(new ->Text document). Add a new text file within USB(within USB root, not within any folder in USB) and rename it to RECYCLER without the .txt extension. To show the extension, open up Windows Explorer window, press Alt+T (to show up tools menu), then click "folder options". Now click to open the "View" tab, within it, uncheck the option "Hide extensions for known file types" and click Apply. Similarly create another text file and rename that to MSOCACHE without extension. [Note: Remove the extension ,i.e - >New Text Document.txt to RECYCLER]. 

Setting Attributes 

Now that the files and folder have been created, it is necessary to modify their attributes so that they can't be deleted without your asking for permission. This can be done by setting attribute to read-only, System and Hidden. 

Open up command prompt, type:

ATTRIB +r +s +h  full path of file or folder

i.e.:

ATTRIB +r +s +h I:\Autorun.inf
attrib +r +s +h I:\RECYCLER
attrib +r +s +h I:\MSOCACHE

Rules for creating file or folder

If there are some other files or folder that get infected, then for every folder that you want to prevent virus from penetrating, create a file and for every file, create a folder. I have done just like that. MSOCACHE and RECYCLER are folders in windows explorer so i created a file to replace them . Autorun.inf is a file, so I created a folder to replace it. The rule is, if there is an existing file or folder, then it can't be replaced without deleting existing one.

Case

Some time before, I had helped someone disallow new shortcut virus from penetrating the USB. He was complaining that whenever he inserted his USB drive in his system, some files by name of new shortcut got inside the USB. Antivirus had not been installed in the system because the system was low on memory. I checked the USB and found that viruses had penetrated in the RECYCLER folder, so I deleted the folder and replaced it with an empty file with above attributes. For every new shortcut file, i replaced them with a folder with same name and set the attributes mentioned above. After that when he inserted the same USB in the infected system, the virus never entered!

One more point to be noted. Remove the existing Autorun.inf file and RECYCLER folder or any any other file/folder that you want to replace from your USB before adding new file/folder.(Note: If you have used Panda Usb Vaccine to immunize your USB, it will disallow any modification to Autorun.inf, so it won't be deleted. It's Okay, you don't need to delete the file). Most of the time these files are hidden so you will need to unhide them by going through explorer->tools->folder options ->view ->Show Hidden files and folders (WinXP).

Bonus

Sometime before I had created an application called file attribute changer and submitted that to the codeproject. It allows you to change the attributes of the files and folders at once . Source code and a working demo is available here. http://www.codeproject.com/KB/files/FileAttributeChanger.aspx[^].

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)