Buggy USB Drive?

May 1, 2008 11:26 PM

Can simply connecting an infected jump drive release bugs onto a computer?

I had to connect a thumb drive (I needed to use a password manager on it: PC-Mac Password Vault2go. It runs completely off the jump drive; it doesn't need the Windows registry.) to a computer (Windows) not my own. From a security standpoint, I now have to assume the drive is unsafe. Is it OK to connect it to my own computer to scan it? I don't think it's likely I'd have to bring it to a shop or something, but I've had to re-install Windows before, and it's not fun. (P.S. This was at work, not some keylogger-infested cafe.)

posted by Kronos_to_Earth to computers & internet (8 comments total)

Yes, Windows will auto-execute files on a newly mounted drive unless configured not to.
posted by zippy at 11:37 PM on May 1, 2008

How does one disable auto-execute?
posted by Kronos_to_Earth at 11:55 PM on May 1, 2008

If you have XP Pro, it's slightly easier.
posted by theiconoclast31 at 12:11 AM on May 2, 2008

Vista
Others

or TweakUI
posted by netbros at 12:23 AM on May 2, 2008

Also, you can get some protection from carelessly run programs taking over your whole system by not running as administrator.
posted by grouse at 3:20 AM on May 2, 2008

Most USB Flash Drives, including the Jump Drive, do not autorun. (See here specifically the What must I do to trigger Autorun on my USB storage device? question).

Some devices are available that register themselves both as a removable storage device and a virtual cd-rom, allowing autorun from the latter, but the Jump Drive isn't one of them.

You'll be fine.
posted by st0rey at 4:26 AM on May 2, 2008

You'll be fine.

Well no

Some viruses create an autorun, we've just finished dealing with a monster like this at work. It's certainly possible.
posted by mattoxic at 5:33 AM on May 2, 2008

Yes and no.

There are two types of ways windows handles removeable disks. If the disk itself (this cannot be changed via software) is set to be a certain type of device and returns a certain code then windows will perform an autorun just like it does with CDs. This is a pretty big security nightmare, but in practice most flash manufacturers do not set their devices to do this, but some do. Ive yet to find a flash device that will perform a silent autorun, but they do exist and I imagine some companies sell them for "ease of use."

Typically, windows will see the autorun file and throw you a pop-up asking you what to do. You can also configure autorun to run as you like by using tweakui. This can also configure the silent autorun.
posted by damn dirty ape at 7:22 AM on May 2, 2008