Thursday, 29 January 2009

A sticky subject

More and more people exchange data using memory sticks these days and guess what – those friendly Virus writers have designed a new type of Trojan that takes full advantage of a basic feature of Windows, the Autorun.

Autorun is a feature originally intended for use with CD Drives. It scans the disc when you put it in and tries to decide what action to take. If it finds a file called Autorun.inf it follows the instructions in the file. Unfortunately the existence of an Autorun.inf on any drive, including memory sticks and your own hard drive, will be recognised by windows and provide the perfect place for hackers to launch their unwanted code.

The latest version, called Downadup or Conficker, disables a lot of important Windows features and attempts to capture key data, such as passwords from your machine. It spreads to other machines by copying its own autorun.inf to any drive it comes into contact with including network drives and, of course, memory sticks.

To protect against infection you can disable the ability of Autorun.inf to work by making a change in the registry. Go to http://antivirus.about.com/od/securitytips/ht/autorun.htm for detailed information on how to do this or call your friendly local IT man.

If you are already infected then a really good (free) removal tool is MalwareBytes Anti-Malware available from http://www.malwarebytes.org/. This can be run in conjunction with existing antivirus products and often finds a lot of things missed by the mainstream products such as MacAfee etc.

As always the best way to avoid viruses on your PC is to be vigilant. So think twice before sticking your stick into someone else’s computer or letting them stick it to yours.

 Hope this helps.