USB flash drive (auto virus) virus Analysis and Solution

You must disable automatic playback when using a USB flash drive, and then use anti-virus first.

I. Brief introduction to the USB flash drive virus:

The USB flash drive (auto virus) is very common recently and has a certain degree of harm. Its Mechanism is to rely on Windows's automatic operation function, so that when we click to open the disk, automatically execute related files. At present, we use USB flash drives very frequently. When we enjoy the convenience of USB flash drives, the USB flash drive virus is also quietly spreading through the system's automatic operation function, we are even familiar with the popular USB flash drive virus files, such as SSS, which is frequently asked by netizens. exe sxs. EXE how to kill this type of virus, we will analyze and summarize the features and preventive measures of the U disk virus.

Ii. Feature Analysis:

The so-called automatic running function is a convenient feature of the Windows system, so that when the disc, U disk inserted into the machine for automatic operation, and the implementation of this feature is through the disk and directory autorun. inf file. This file is stored in the root directory of the drive (usually a system file with hidden attributes). It stores some simple commands, inform the System of the program that should be automatically started for the newly inserted CD or USB flash disk.

The common Autorun. inf file formats are roughly as follows:

[AutoRun] // indicates that the AutoRun part starts and must be entered

Icon = C: C. ico // specify a personalized drive letter icon for drive C. ico

Open = C: 1.exe // specify the path and name of the program to be run. The program runs automatically as long as the virus program is put here;

In Windows, you can use the following methods to allow and block automatic operation:

Find the following key in the registry:

Key Path: [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExploer]

The "NoDriveTypeAutoRun" key in the right pane determines whether to perform the Autorun function. Each digit represents a device, and each device is represented by the following value:

The device name. The device name must contain the following values:

DRIVE_UNKNOWN 0 1 01 h unrecognized Type Device

DRIVE_NO_ROOT_DIR 1 0 02 h no driver for the root directory

DRIVE_REMOVABLE 2 1 04 h removable drive

DRIVE_FIXED 3 0 08 h fixed drive

DRIVE_REMOTE 4 1 10 h network drive

DRIVE_CDROM 5 0 20 h Optical Drive

DRIVE_RAMDISK 6 0 40 h RAM disk

Where: retain the drive type not specified for 7 1 80 h

The value "0" indicates that the device is running, and "1" indicates that the device is not running.

As shown above, the corresponding DRIVE_NO_ROOT_DIR, DRIVE_FIXED, DRIVE_CDROM, and DRIVE_RAMDISK can be run automatically. To disable the automatic running of the AutoRun. inf file on the hard disk, you must set the value of the DRIVE_FIXED keys to 1, because DRIVE_FIXED represents a fixed Driver (that is, the hard disk ). If you only want to disable the AutoRun function of the software disc, but retain the automatic playback capability of the CD audio disc, you only need to change the "NoDriveTypeAutoRun" key value to: BD, 00.

The USB flash drive virus uses this system feature. Generally, after infection, the registry of the system is modified, and the option of displaying all files is disabled. Or even modify the Disk Association. Anti-virus software usually only clears the virus files, but does not process the residual files. This is also the reason why common anti-virus software is often unable to be cleared, or the disk cannot be opened by double-clicking after cleanup.

Iii. solution:

1. Use the super patrol suit to comprehensively solve the problem of USB flash drive virus (recommended !) :

① Super patrol officers have specially processed the USB flash drive virus detection to quickly monitor and locate the USB flash drive virus and clear them.

② Super patrol also provides handling of Registry Association repair and automatic operation blocking.

2. Manual solution:

① According to the above principle, modify the Registry to disable automatic operation of disks.

② Hide the protected operating system files in the folder options, select and display all files and folders, and click OK. In this way, you can see several files (including autorun. inf and virus files) on the infected mobile storage device. After deletion, the virus is cleared.