Panda USB and AutoRun Vaccine
UPDATE October 8, 2009: New version 1.0.1.4 released.
The Microsoft Windows Operating Systems use the AUTORUN.INF file from removable drives in order to know which actions to perform when a new external storage device, such as a USB drive or CD/DVD, is inserted into the PC. The AUTORUN.INF file is a configuration file that is normally located in the root directory of removable media and contains, among other things, a reference to the icon that will be shown associated to the removable drive or volume, a description of its content and also the possibility to define a program which should be executed automatically when the unit is mounted.
The problem is that this feature, widely critizised by the security community, is used by malware in order to spread by infecting as soon as a new drive is inserted in a computer. The malware achieves this by copying a malicious executable in the drive and modifying the AUTORUN.INF file so that Windows opens the malicious file silently as soon as the drive is mounted. The most recent examples of this are the W32/Sality, W32/Virutas and also the W32/Conficker worm which, in addition to spreading via a vulnerability and network shares, also spreads via USB drives.
Due to the large amount of malware-related problems associated with Microsoft AutoRun we have created a free utility for our user community called Panda USB Vaccine.
Computer Vaccination
The free Panda USB Vaccine allows users to vaccinate their PCs in order to disable AutoRun completely so that no program from any USB/CD/DVD drive (regardless of whether they have been previously vaccinated or not) can auto-execute. This is a really helpful feature as there is no user friendly and easy way of completely disabling AutoRun on a Windows PC.
USB Vaccination
The free Panda USB Vaccine can be used on individual USB drives to disable its AUTORUN.INF file in order to prevent malware infections from spreading automatically. When applied on a USB drive, the vaccine permanently blocks an innocuous AUTORUN.INF file, preventing it from being read, created, deleted or modified. Once applied it effectivelly disables Windows from automatically executing any malicious file that might be stored in that particular USB drive. The drive can otherwise be used normally and files (even malware) copied to/from it, but they will be prevented from opening automatically. Panda USB Vaccine currently only works on FAT & FAT32 USB drives. Also keep in mind that USB drives that have been vaccinated cannot be reversed except with a format.
Download
Panda USB Vaccine is a 100% free utility. We’ve tested it under Windows 2000 SP4, Windows XP SP1-SP3, and Windows Vista SP0 and SP1. Feedback is always welcomed. Click on the download button below to start downloading.
Command line Operation
For advanced users who wish to run Panda USB Vaccine automatically at boot to notify every time a new USB device is mounted on the system or to perform network-wide computer vaccinations via login scripts or other distribution methods, Panda USB Vaccine can be operated via command-line. Its input parameters are the following:
USBVaccine.exe [ A|B|C|Z ] [ +system|-system ] [ /resident [/hidetray] ]
[drive unit]: Vaccinate drive unit
+system: Computer vaccination
-system: Remove computer vaccination
/resident: Start program hidden and prompt for vaccinating every new drive
/hidetray: Hides tray icon when used with the /resident command
Examples:
To vaccinate USB drives F:\ and G:\, use
USBVaccine.exe F G
To vaccinate the computer, use
USBVaccine.exe +system
To vaccinate computer and prompt for vaccinating every new drive without showing a tray icon, use
USBVaccine.exe /resident /hidetray +system
It could be very useful to create a Shortcut in the Startup folder to USBVaccine.exe with this last command line (or without the /hidetray) to make sure that every time you boot the computer USBVaccine gets loaded by the system and it vaccinates the computer and prompts the user for vaccinating any new non-vaccinated USB drive. However if you do this under Vista, UAC will block it from running at Startup as it requires admin priviledges. We’ll fix this in future versions.
Cool! thanks.. Now my USB is secure..!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! byee..
This software works great; thank you.
One concern: When I enable NTFS, it tries to vaccinate my external hard drive and then hangs for some time. When it did this and my drive was inaccessible, I panicked and terminated the program. Is it supposed to protect hard drives just the same as flash drives, and if so, will it take a long time to vaccinate?
Thanks
Ben
@Ben, the NTFS vaccination process takes some time, which is relative to the capacity of the drive (the larger the drive, the longer the time). While vaccinating it is important NOT to interfere with the process or cancel. If you have cancelled it, run chkdsk /f on the disk and run vaccination again.
thank u
A very good tool!!!
The file AUTORUN.INF created in USB is actually undeletable! When I tried to unhide with the DOS command “attrib -r -s -h AUTORUN.INF” and then delete it, has the message “access denied”.
I spread this tool for everyone!
Thanks a lot.
Need to update my Panda USB Vaccine
realy so sorry panda vaccinate is verry bad tools it must be fixd………. because of many dameg to mi so i will never use panda never
@Ricky, simply download it again from this site and then install.
I still would like to see a ZIP package of USB Vaccine so that I can extract it and go… The installer is nice, but for my USB toolkit, I’d like the .ZIP
@Keith, you can simply install on any PC and then grab the “USBVaccine.exe” file which gets installed into “Program Files\Panda USB Vaccine” and save it to your USB toolkit. The USBVACCINE.EXE file that gets installed is portable.
No ato da instalação recebi a mensagem Unable to execute file: schtasks.exe Create process failed, code 2 O sistema não pode encontrar o arquivo especificado.
Abri a janela do DOS, digitei “schtasks” com e sem apóstrofes, e recebi a seguinte resposta:
Schtasks não é reonhecido como um programa interno ou externo, um programa operável ou arquivo em lotes.
Como devo proceder, tenho um windows XP versão 5.1.260 que briga com um HD externo, que já foi devidamente formatado e não quero e não posso perder as informações que gravei.
Obrigada pela atenção
Cynthia
Understood…
Thanks for the response!
Hi, great tool, only you schould not turn on automatic vacination, reason being if you put in a magic jack it will also be vacinated and the magic jack will not wotrk any more
Took me some time but i managed to remove the protected autorun.inf and restore the original, but still a great tool
@Curd, during install you can simply not check the “automatically vaccinate any new USB” option and it won’t do it.
Screenshot:
http://research.pandasecurity.com/blogs/images/usbvaccine/usbvaccine1.5.setup.jpg
hi! your program is best for defense usb drive! thank’s for good and free prog. when planing come new version with final support NTFS file system?
@Diwakar Palsule:
That is hopefully the autorun.inf created AFTER vaccination, so you have nothing to fear. The idea is precisely to have it there.
WinHex trick didn’t worked here.
To have an “undo option” regarding created autorun.inf files is not a good idea because malware authors could reverse engineering the app and make us unhappy.
There’s a new version (1.0.1.4) available @ download.com.
Tested with 5 sticks (1, 2, 4, 8 and 16 Gb) along six months and everything is working fine. Thanks a lot and greetings from Brazil.
I don’t know why it is diabled to vaccine usb in the program. plz help
i vaccinate my usb,but now there is a big problem:
i can not copy , read or write any document in my flash usb. the bigger problem is that i can not even format it.
pls guide me if there is a solutionotherwise do not publish these … programs.
tanks
@Lord, this does not seem to me related to USBVaccine. It seems as your OS is not able to access the USB drive correctly. Try inserting it in another PC or different OS to see if it’s accessible from there.
Hi
After instal this program on few computers (Windows XP +SP2) I’ve been getting an error message every few minutes :
Windows – drive not ready
Exception Processing Message c00000a3 Parameters
75b6bf9c 4 75b6bf9c 75b6bf9c
What is it?
Can anybody help me to remove this problem
Thanks
Boris
This happen if in motheboard BIOS Enable Floppy Drive Controller, but the Floppy Drive is absent. Please DISABLE you Floppy Drive Controller in BIOS, and problem must be solved.
.
PS Sorry for my English
Thanks Dale !
Hi!
I have installed a software (PortableApps) on my USB flash drive, but after using the Panda USB Vaccine, my flash drive looses the autorun function, so that I have to manually run the PortableApps excutable file in order to use it.
Is there any way to vaccinate my drive by just changing the original autorun.inf file attributes to unwritable, instead of overwriting the autorun.inf with a blank file with unwritable attributes?
Thanks.
its simply great ………
Hi there,i am using the Panda USB and AutoRun Vaccine 1.0.0.50.My first guestion is,is this the latest ie most recent one,as i am not sure i can tell.
Also lately the vaccine does not seem to work effectively anymore,as during scanning USB memory sticks,my ‘real time’Antivirus finds a virus sometimes NOT on the USB stick but on the computer.This has happened twice now even though Said USB memory stick and computer ARE vaccinated.Ä°t seems as though the AutoRun is not disabled as it should be.
Ä° would appreciate any reply.Thank you.
why is it connect network ?
Thanks
@Peter, what do you mean exactly?
“Vaccination not possible due to error reading volume on pen drive”
What is it?
Thanks!
@Iuri, can you access you USB drive otherwise and write to it?
how do ubdate panda vaccine
@alireza, simply uninstall the version you have installed, then download the new version and install again.
HI this is avinash from india i am having an autorun.inf virus in my personal computer
so i need sugesstion from your side, mean to say how i suppose to remove that virus from my computer
in usb just said…..vaccination was no possible
no fue posible la vacunacion
Hi I have selected to show all system files, on my memory stick I have a autorun.inf and a floder called zolander. If I format the stick then the files reappear when you refresh, your usb vaccine says the stick is vaccinated and does not pick up the autorun.inf file as a virus
Please can you assist
I posted a problem here today 7th & now it does not appear ??? it was posted on site & I was waiting for reply ????
get error reading volume on ie8 sp 2 vista home. tried the new vers on download not help. beta link would be nice if fix problem . thanks did vaccine comp. just not usb yet.
thx for this tool
I was in bad need for somthing like it
I hope it will be benfit for me
I clicked vaccinate usb and it took too much time because my cpu was busy so i removed the usb and now the usb is not detected by any cmputer. IT RUINED MY USB.
With reference to below, I’m still waiting for feedback ????
Hi I have selected to show all system files, on my memory stick I have a autorun.inf and a floder called zolander. If I format the stick then the files reappear when you refresh, your usb vaccine says the stick is vaccinated and does not pick up the autorun.inf file as a virusPlease can you assist>
Great solution to the nasty autorun.inf bugs, but …
1. I’m still having a little bit of trouble with the vaccination process.
This is due to having other antivirus softwares (trendmicro) that block user access to usb pens… The workaround was to unload TM and then it worked.
2. Hoping to see any “settings” menu …
this a message when run the ‘USB VACCINE” : exception processing message c0000a3 parameters 75b3bf7c 4 75b3bf7c 75b3bf7c
Cancelar tentar novamente continuar
Autorun.inf file is an application file embedded into your memory stick, its no threat to Panda, this file outo opens your memory files for you to access more with ease. it cant be deleted its emabedded into its ‘fixed startup memory’.chow@PiETER
After posting a problem here and still waiting for response i Feel that this place to post problems is a total waste of time you can simply look at the posts and the fact there is zero response. PANDA SOFTWARE I AM REALLY DISAPPOINTED !!!!
Nice tool, but the technique used to “permanently” vaccinate USB pen drives, since v1.0.1.4 (before this version, it used the autorun.inf folder + reserved names like LPT1), involves a risky operation, i.e. direct editing of the FAT tables, described here: http://www.autoitscript.com/forum/index.php?showtopic=94076.
Be careful…
1 – I want to choose icon files
ICON=ICON.ICO
2 – I want to give name to Usb Drive
LABEL=SANDISK
3 – Panda folder can be create in Usb Drive & include Scanner.exe
Scanner.exe = Your USB Drive Viruses Scanner & Cleaner File
4 – When i plugin USB Drive there can be a part which i can choose with clicking right mouse.
shell\Panda=Scan with Panda USB Vaccine
shell\Panda\command=Scanner.exe
Example:
hxxp://rapidshare.com/files/320372917/1.rar.html
Thank you so much for this!!! I’ll blog this one