Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: windows virus on USB sticks

  1. #1
    Join Date
    Aug 2006
    Location
    North East England
    Beans
    576
    Distro
    Ubuntu

    windows virus on USB sticks

    Hi all,

    I'm fairly happy I have the right answer on this, but would like to get confirmation from the community for my own peace of mind. Here's the situation:

    I have 3 USB memory stick that are all showing up on Windows machines as a folder, not a USB drive. As a result it is inaccessible. On suspicion of a virus, I have examined it using Mac OS X and found the presence of an autorun.inf file, which is 'locked', and a suspicious looking executable called cafgm.exe in the RECYCLER folder on the stick. The autorun.inf is displayed as a unix executable file in Mac OS X. I can delete the files fine, even though the autofun.inf is showing up as 'locked'

    My understanding is that Linux/unix machines are immune to Windows viruses so I can just delete the files from the stick (since it is FAT32) and all will be well again. What I would like to do however is examine the autorun.inf to confirm that it is indeed causing the abnormal mounting behaviour observed in Windows.

    So what I would like confirmation of is that using cat to display the contents of the autorun.inf file in Terminal is perfectly safe to do. Ordinarily I wouldn't worry one bit about this, it's just that Mac OS X displays the file as a unix executable in Finder, which had me somewhat puzzled.

    Can someone please confirm using cat to view the file is ok to do?

    Thanks

    Ben

  2. #2
    Join Date
    May 2007
    Location
    Delaware
    Beans
    92

    Re: windows virus on USB sticks

    You are correct. Linux/Unix is immune to Windows viruses. Removing and/or inspecting the autorun.inf is safe. You can also use the program "file-roller" to inspect the contents of the .exe, it will treat the .exe as an archive (zip,tar,etc)

  3. #3
    Join Date
    Jan 2009
    Location
    UK
    Beans
    247
    Distro
    Ubuntu 11.10 Oneiric Ocelot

    Re: windows virus on USB sticks

    I can confirm windows viruses cannot affect Ubuntu (or linux) but could infect windows machines (if you care about that sort of thing LOL)

    Try installing "ClamTK" (GUI version with & for Clamav) or "ClamAV" (Terminal version) if you wish to remove them in Ubuntu.

    For some reason you have to type "sudo freshclam" in a teminal window (or Hold Alt + F2 keys down to update signatures but aside from an update button its fine. Only use on pen drives or home folder though, don't use it on Linux filesystem (Full system scan) as it suffers from "False positives" and could break ubuntu, don't set it to auto delete mode either you need to check whether its a "False Positive" before deleting.

    It was originally ment as an email virus scanner but great for Usb drives or odd folders you suspect to be virused (Non system)
    Linux Mint 12 (11.10 Based) Gnome 3.0 User

  4. #4
    Join Date
    Dec 2005
    Location
    What a weird trip.....
    Beans
    4,676
    Distro
    Ubuntu 12.04 Precise Pangolin

    Cool Re: windows virus on USB sticks

    You also may consider simply formatting the drive to erase all of the data and reset the file system on the drive.
    If at first you don't succeed - just buy the company and tell them to make the one you want.

  5. #5
    pricetech is offline Iced Blended Vanilla Crème Ubuntu
    Join Date
    Apr 2008
    Beans
    1,656

    Re: windows virus on USB sticks

    A normal "autorun.inf" file is just a text file. You can look at it in a text editor if you prefer.

    I'd use gparted to remove the partition if you're really concerned about a virus. Then format it on a winders box if you plan to use it with winders.

  6. #6
    Join Date
    Jun 2007
    Location
    Porirua, New Zealand
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: windows virus on USB sticks

    Quote Originally Posted by pricetech View Post
    A normal "autorun.inf" file is just a text file. You can look at it in a text editor if you prefer.
    +1
    I'd be more worried about whatever programs/data the autorun.inf points to than its actual presence.

    More info on autorun can be found here:
    http://en.wikipedia.org/wiki/AutoRun
    http://en.wikipedia.org/wiki/AutoPlay
    Forum DOs and DON'Ts
    Never assume that information you find using a search engine is up-to-date.
    Please use CODE tags.

  7. #7
    Join Date
    Aug 2006
    Location
    North East England
    Beans
    576
    Distro
    Ubuntu

    Re: windows virus on USB sticks

    Hi all, thanks for your replies, that's pretty much what I thought.

    Just to clarify the reasons for my paranoia regarding the autorun; I'm aware that they commonly exist and are normally nothing to worry about; however, this memory stick should definitely NOT have an autorun.inf present, as the stick was formatted immediately after purchase to remove all the bundled junk that came with it. That's what was making me paranoid.

    Thanks again

    Ben

  8. #8
    Join Date
    Dec 2005
    Location
    Western Australia
    Beans
    11,480
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: windows virus on USB sticks

    Just use 'cat'. Cat won't execute the file, it will merely read it.

    Actually I'd suggest using 'less' instead:

    Code:
    less autorun.inf
    I try to treat the cause, not the symptom. I avoid the terminal in instructions, unless it's easier or necessary. My instructions will work within the Ubuntu system, instead of breaking or subverting it. Those are the three guarantees to the helpee.

  9. #9
    Join Date
    Oct 2007
    Beans
    79

    Re: windows virus on USB sticks

    I'm not 100% sure on this, but I think it's windows that creates the autorun.inf when you plug your USB in. Same for Recycled and other hidden folders. (I usually erase them from Linux and, indeed, they re-appear after plugging it to a Windows machine)

    As windows is in charge of the file, that explains why so many trojans can access the file and make it point to their own virus executables.

  10. #10
    Join Date
    Oct 2009
    Location
    Finland
    Beans
    168
    Distro
    Ubuntu 11.10 Oneiric Ocelot

    Re: windows virus on USB sticks

    Quote Originally Posted by QuimNuss View Post
    I'm not 100% sure on this, but I think it's windows that creates the autorun.inf when you plug your USB in.
    I have never seen windows do that. (i mean virus free windows)
    Have been using usb sticks in windows and linux since usb sticks came to market.
    ---
    Be paranoid. God is always building a better idiot.

Page 1 of 2 12 LastLast

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •