USB Guardian - for USB security

[Anupam]

USB drives can be a major source of malware infection on the PC. There are some programs available to tackle this problem like Panda USB Vaccine, Ninja Antivirus, MX One Antivirus, Flash Disinfector, iKill. Here is another program for USB security.

This one is called USB Guardian. Once installed on the PC, it keeps scanning the USB ports, for devices. As soon as a USB device is plugged in, it locks the autorun file present on the USB drive, and thus prevents infection. It also locks the executable files, that have been referenced in the autorun file, which it finds suspicious. You can afterwards choose to manually disable the lock, if the file appears to be clean.

USB Guardian Homepage : http://www.usb-guardian.com/

How it works : http://www.usb-guardian.com/how-it-works-.html

Original source : http://www.ghacks.net/2010/03/27/usb...ives-guardian/

Seems like a good software. I think if you use this software, you won't need software like Panda USB Vaccine, which removes autorun ability from the PC.

Originally Posted by Anupam

USB drives can be a major source of malware infection on the PC. There are some programs available to tackle this problem like Panda USB Vaccine, Ninja Antivirus, MX One Antivirus, Flash Disinfector, iKill. Here is another program for USB security.

This one is called USB Guardian. Once installed on the PC, it keeps scanning the USB ports, for devices. As soon as a USB device is plugged in, it locks the autorun file present on the USB drive, and thus prevents infection. It also locks the executable files, that have been referenced in the autorun file, which it finds suspicious. You can afterwards choose to manually disable the lock, if the file appears to be clean.

USB Guardian Homepage : http://www.usb-guardian.com/

How it works : http://www.usb-guardian.com/how-it-works-.html

Original source : http://www.ghacks.net/2010/03/27/usb...ives-guardian/

Seems like a good software. I think if you use this software, you won't need software like Panda USB Vaccine, which removes autorun ability from the PC.

Sounds interesting but I admit I don't use USB drives that often, only for the small ReadyBoost performance that they give. You could of course achieve the same thing yourself, but why bother if an organisation you trust has already done it for you?

I'd be interested to hear which product comes out top as I recently built a new x64, 4Gb RAM, 300+Gb hard drive, etc, laptop, running 64 bit Windows 7 for my Sister. Doubless this whole matter should have been caught in that process

Regards,

Rik

[wdhpr]

This one is called USB Guardian. Once installed on the PC, it keeps scanning the USB ports, for devices. As soon as a USB device is plugged in, it locks the autorun file present on the USB drive, and thus prevents infection. It also locks the executable files, that have been referenced in the autorun file, which it finds suspicious. You can afterwards choose to manually disable the lock, if the file appears to be clean.

The new version of Avira AV does pretty much the same thing. Allthough I am using the premium version. I believe this feature is available in the free version.

Cheers
Wdhpr

[Anupam]

I put this software to test today, and disappointingly, it failed!!

I today had gone to a cyber cafe to get some scans, and I got them in a pen drive. The PC on the cyber cafe is infected, and it put two extra files on the pen drive, along with the scan files.

I had an infection some days ago, from the same cyber cafe. Well, I know, I should not have gone there, but its the only decent cafe nearby, and I had urgent work.

Learning a lesson from the last time, I had disabled the autorun feature of pen drive on my PC, and I was sure that this time the pen drive would not autorun.

So, on that confidence, I installed USB Guardian and decided to test it, since it claims it locks the autorun file, and also the files associated with it.

I installed and started USB Guardian, and I plugged in my pen drive. Sure thing, USB Guardian popped up, and asked to open the drive. I thought OK, since it must have locked the pen drive, it must be safe to open the drive with USB Guardian. But, that was my mistake. Opening with USB Guardian was like enabling autorun on the drive... I clicked OK, and boom, my PC was infected, yet again!!

Fortunately, the infection was removed by Malwarebytes Antimalware... and needless to say, USB Guardian is out of my PC, for good!!

[Sope]

Wow, not good!

I'm glad you tested it in a real world scenario as I was considering installing this myself. Thanks for the feedback Anupam.

[Anupam]

Yeah, really not good . Learnt it the hard way. Well, atleast now we know, it does not the work the way that it should ... has got some more work to do. I will not be visiting it again for a long time.

[wdhpr]

I to am looking for a solution to the USB infection problem.
It seems there may not be a total automatic solution to the problem.
Blocking the autorun.inf from starting is the first and most important step in protection. As I mentioned in my above statement avira's guard funtion accomplishes this task.

Block autostart function

When this option is enabled, the execution of the Windows Autostart function is blocked on all connected drives, including USB sticks, CD and DVD drives and network drives. With the Windows Autostart function, files on data media or network drives are read immediately on loading or connection, and files can therefore be started and copied automatically. This functionality however carries with it a high security risk, as malware and unwanted programs can be installed with the automatic start. The Autostart function is especially critical for USB sticks as data on a stick can be changed at any time.

Panda USB Vaccine will also do this and its also free. This link will explain the process as well as providing a link for downloading.

The only solution other than blocking the autorun that I can tell is scan the contents of the usb drive before opening it.

Anupam
I am curious why your residential AV did not block the virus before it infected your system.

Cheers
Wdhpr

[Anupam]

Yes, at the moment, Panda USB Vaccine seems to be a good choice for security regarding pen drives. Earlier it used to turn off the autorun feature for the whole PC it seems... but now it can selectively turn off this feature for the USB drives, and that is good.

What Avira offers is a good feature. It will turn off the autorun feature for the whole system though, and many people may not desire that. Autorun feature for the optical drives is helpful.

I am using Avast as my resident AV, and yea, I was disappointed that Avast did not pick up the infection. I even scanned the drive with Avast, but still it did not pick it up. I am still keeping my faith with Avast, and think that its one of those infections, that is not meant to be picked up by AVs, but by antispywares. But yes, I was disappointed.

[MidnightCowboy]

I use TweakUI which does a lot of other things too like removing the shortcut arrows. In addition to choosing which type of autorun you want to allow or disallow, you can choose individual drives as well.
Attachment 506

[Anupam]

Thanks MC, that looks like a good option too .