Home > Utils > Panda USB and AutoRun Vaccine

Panda USB and AutoRun Vaccine

March 5th, 2009

UPDATE October 8, 2009: New version 1.0.1.4 released.

The Microsoft Windows Operating Systems use the AUTORUN.INF file from removable drives in order to know which actions to perform when a new external storage device, such as a USB drive or CD/DVD, is inserted into the PC. The AUTORUN.INF file is a configuration file that is normally located in the root directory of removable media and contains, among other things, a reference to the icon that will be shown associated to the removable drive or volume, a description of its content and also the possibility to define a program which should be executed automatically when the unit is mounted.

The problem is that this feature, widely critizised by the security community, is used by malware in order to spread by infecting as soon as a new drive is inserted in a computer. The malware achieves this by copying a malicious executable in the drive and modifying the AUTORUN.INF file so that Windows opens the malicious file silently as soon as the drive is mounted. The most recent examples of this are the W32/Sality, W32/Virutas and also the W32/Conficker worm which, in addition to spreading via a vulnerability and network shares, also spreads via USB drives.

Due to the large amount of malware-related problems associated with Microsoft AutoRun we have created a free utility for our user community called Panda USB Vaccine.

Computer Vaccination

The free Panda USB Vaccine allows users to vaccinate their PCs in order to disable AutoRun completely so that no program from any USB/CD/DVD drive (regardless of whether they have been previously vaccinated or not) can auto-execute. This is a really helpful feature as there is no user friendly and easy way of completely disabling AutoRun on a Windows PC.

USB Vaccination

The free Panda USB Vaccine can be used on individual USB drives to disable its AUTORUN.INF file in order to prevent malware infections from spreading automatically. When applied on a USB drive, the vaccine permanently blocks an innocuous AUTORUN.INF file, preventing it from being read, created, deleted or modified. Once applied it effectivelly disables Windows from automatically executing any malicious file that might be stored in that particular USB drive. The drive can otherwise be used normally and files (even malware) copied to/from it, but they will be prevented from opening automatically. Panda USB Vaccine currently only works on FAT & FAT32 USB drives. Also keep in mind that USB drives that have been vaccinated cannot be reversed except with a format.

Download

Panda USB Vaccine is a 100% free utility. We’ve tested it under Windows 2000 SP4, Windows XP SP1-SP3,  and Windows Vista SP0 and SP1. Feedback is always welcomed. Click on the download button below to start downloading.

Get it from CNET Download.com!

Command line Operation

For advanced users who wish to run Panda USB Vaccine automatically at boot to notify every time a new USB device is mounted on the system or to perform network-wide computer vaccinations via login scripts or other distribution methods, Panda USB Vaccine can be operated via command-line. Its input parameters are the following:

USBVaccine.exe [ A|B|C|Z ] [ +system|-system ] [ /resident [/hidetray] ]

[drive unit]:     Vaccinate drive unit
+system:      Computer vaccination
-system:        Remove computer vaccination
/resident:      Start program hidden and prompt for vaccinating every new drive
/hidetray:      Hides tray icon when used with the /resident command

Examples:
To vaccinate USB drives F:\ and G:\, use
USBVaccine.exe F G

To vaccinate the computer, use
USBVaccine.exe +system

To vaccinate computer and prompt for vaccinating every new drive without showing a tray icon, use
USBVaccine.exe /resident /hidetray +system

It could be very useful to create a Shortcut in the Startup folder to USBVaccine.exe with this last command line (or without the /hidetray) to make sure that every time you boot the computer USBVaccine gets loaded by the system and it vaccinates the computer and prompts the user for vaccinating any new non-vaccinated USB drive. However if you do this under Vista, UAC will block it from running at Startup as it requires admin priviledges. We’ll fix this in future versions.

Categories: Utils Tags:
  1. http://
    September 7th, 2009 at 02:42 | #1

    Cool! thanks.. Now my USB is secure..!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! byee..

  2. http://
    September 8th, 2009 at 22:23 | #2

    This software works great; thank you.

    One concern: When I enable NTFS, it tries to vaccinate my external hard drive and then hangs for some time. When it did this and my drive was inaccessible, I panicked and terminated the program. Is it supposed to protect hard drives just the same as flash drives, and if so, will it take a long time to vaccinate?

    Thanks
    Ben

  3. Pedro Bustamante
    September 11th, 2009 at 10:47 | #3

    @Ben, the NTFS vaccination process takes some time, which is relative to the capacity of the drive (the larger the drive, the longer the time). While vaccinating it is important NOT to interfere with the process or cancel. If you have cancelled it, run chkdsk /f on the disk and run vaccination again.

  4. http://
    September 12th, 2009 at 15:36 | #4

    thank u

  5. http://
    September 13th, 2009 at 01:06 | #5

    A very good tool!!!
    The file AUTORUN.INF created in USB is actually undeletable! When I tried to unhide with the DOS command “attrib -r -s -h AUTORUN.INF” and then delete it, has the message “access denied”.

    I spread this tool for everyone!

    Thanks a lot.

  6. http://
    September 13th, 2009 at 05:12 | #6

    Need to update my Panda USB Vaccine

  7. http://
    September 13th, 2009 at 10:03 | #7

    realy so sorry panda vaccinate is verry bad tools it must be fixd………. because of many dameg to mi so i will never use panda never

  8. Pedro Bustamante
    September 13th, 2009 at 18:53 | #8

    @Ricky, simply download it again from this site and then install.

  9. http://
    September 18th, 2009 at 12:39 | #9

    I still would like to see a ZIP package of USB Vaccine so that I can extract it and go… The installer is nice, but for my USB toolkit, I’d like the .ZIP

  10. Pedro Bustamante
    September 19th, 2009 at 01:03 | #10

    @Keith, you can simply install on any PC and then grab the “USBVaccine.exe” file which gets installed into “Program Files\Panda USB Vaccine” and save it to your USB toolkit. The USBVACCINE.EXE file that gets installed is portable.

  11. http://
    September 20th, 2009 at 03:24 | #11

    No ato da instalação recebi a mensagem Unable to execute file: schtasks.exe Create process failed, code 2 O sistema não pode encontrar o arquivo especificado.
    Abri a janela do DOS, digitei “schtasks” com e sem apóstrofes, e recebi a seguinte resposta:
    Schtasks não é reonhecido como um programa interno ou externo, um programa operável ou arquivo em lotes.
    Como devo proceder, tenho um windows XP versão 5.1.260 que briga com um HD externo, que já foi devidamente formatado e não quero e não posso perder as informações que gravei.
    Obrigada pela atenção
    Cynthia

  12. http://
    September 20th, 2009 at 16:29 | #12

    Understood… :) Thanks for the response!

  13. Curd Wong
    September 22nd, 2009 at 14:46 | #13

    Hi, great tool, only you schould not turn on automatic vacination, reason being if you put in a magic jack it will also be vacinated and the magic jack will not wotrk any more

    Took me some time but i managed to remove the protected autorun.inf and restore the original, but still a great tool

  14. Pedro Bustamante
    September 22nd, 2009 at 18:06 | #14

    @Curd, during install you can simply not check the “automatically vaccinate any new USB” option and it won’t do it.
    Screenshot:
    http://research.pandasecurity.com/blogs/images/usbvaccine/usbvaccine1.5.setup.jpg

  15. http://
    October 6th, 2009 at 21:04 | #15

    hi! your program is best for defense usb drive! thank’s for good and free prog. when planing come new version with final support NTFS file system?

  16. Pedro Bustamante
    October 7th, 2009 at 19:37 | #16

    @Diwakar Palsule:

    That is hopefully the autorun.inf created AFTER vaccination, so you have nothing to fear. The idea is precisely to have it there.

    WinHex trick didn’t worked here.

    To have an “undo option” regarding created autorun.inf files is not a good idea because malware authors could reverse engineering the app and make us unhappy.

    There’s a new version (1.0.1.4) available @ download.com.

    Tested with 5 sticks (1, 2, 4, 8 and 16 Gb) along six months and everything is working fine. Thanks a lot and greetings from Brazil.

  17. Pedro Bustamante
    October 12th, 2009 at 18:46 | #17

    I don’t know why it is diabled to vaccine usb in the program. plz help

  18. Pedro Bustamante
    October 14th, 2009 at 11:20 | #18

    i vaccinate my usb,but now there is a big problem:
    i can not copy , read or write any document in my flash usb. the bigger problem is that i can not even format it.
    pls guide me if there is a solutionotherwise do not publish these … programs.
    tanks

  19. Pedro Bustamante
    October 14th, 2009 at 16:05 | #19

    @Lord, this does not seem to me related to USBVaccine. It seems as your OS is not able to access the USB drive correctly. Try inserting it in another PC or different OS to see if it’s accessible from there.

  20. http://
    October 14th, 2009 at 19:13 | #20

    Hi
    After instal this program on few computers (Windows XP +SP2) I’ve been getting an error message every few minutes :

    Windows – drive not ready
    Exception Processing Message c00000a3 Parameters
    75b6bf9c 4 75b6bf9c 75b6bf9c

    What is it?
    Can anybody help me to remove this problem

    Thanks

  21. http://
    October 15th, 2009 at 13:45 | #21

    Boris

    This happen if in motheboard BIOS Enable Floppy Drive Controller, but the Floppy Drive is absent. Please DISABLE you Floppy Drive Controller in BIOS, and problem must be solved.
    PS Sorry for my English :).

  22. Pedro Bustamante
    October 15th, 2009 at 19:42 | #22

    Thanks Dale !

  23. Pedro Bustamante
    October 17th, 2009 at 02:33 | #23

    Hi!

    I have installed a software (PortableApps) on my USB flash drive, but after using the Panda USB Vaccine, my flash drive looses the autorun function, so that I have to manually run the PortableApps excutable file in order to use it.

    Is there any way to vaccinate my drive by just changing the original autorun.inf file attributes to unwritable, instead of overwriting the autorun.inf with a blank file with unwritable attributes?
    Thanks.

  24. Pedro Bustamante
    October 18th, 2009 at 10:00 | #24

    its simply great ………

  25. Pedro Bustamante
    October 18th, 2009 at 13:20 | #25

    Hi there,i am using the Panda USB and AutoRun Vaccine 1.0.0.50.My first guestion is,is this the latest ie most recent one,as i am not sure i can tell.

    Also lately the vaccine does not seem to work effectively anymore,as during scanning USB memory sticks,my ‘real time’Antivirus finds a virus sometimes NOT on the USB stick but on the computer.This has happened twice now even though Said USB memory stick and computer ARE vaccinated.Ä°t seems as though the AutoRun is not disabled as it should be.

    Ä° would appreciate any reply.Thank you.

  26. Pedro Bustamante
    October 20th, 2009 at 07:54 | #26

    why is it connect network ?

    Thanks

  27. Pedro Bustamante
    October 20th, 2009 at 10:24 | #27

    @Peter, what do you mean exactly?

  28. Pedro Bustamante
    October 22nd, 2009 at 14:09 | #28

    “Vaccination not possible due to error reading volume on pen drive”

    What is it?

    Thanks!

  29. Pedro Bustamante
    October 23rd, 2009 at 09:32 | #29

    @Iuri, can you access you USB drive otherwise and write to it?

  30. Pedro Bustamante
    October 26th, 2009 at 07:43 | #30

    how do ubdate panda vaccine

  31. Pedro Bustamante
    October 26th, 2009 at 09:30 | #31

    @alireza, simply uninstall the version you have installed, then download the new version and install again.

  32. avinash
    December 4th, 2009 at 09:15 | #32

    HI this is avinash from india i am having an autorun.inf virus in my personal computer
    so i need sugesstion from your side, mean to say how i suppose to remove that virus from my computer

  33. robert
    December 7th, 2009 at 02:30 | #33

    in usb just said…..vaccination was no possible

    no fue posible la vacunacion

  34. Pieter
    December 8th, 2009 at 09:34 | #34

    Hi I have selected to show all system files, on my memory stick I have a autorun.inf and a floder called zolander. If I format the stick then the files reappear when you refresh, your usb vaccine says the stick is vaccinated and does not pick up the autorun.inf file as a virus
    Please can you assist

  35. pieter
    December 8th, 2009 at 14:36 | #35

    I posted a problem here today 7th & now it does not appear ??? it was posted on site & I was waiting for reply ????

  36. Greg Bernrd
    December 8th, 2009 at 15:17 | #36

    get error reading volume on ie8 sp 2 vista home. tried the new vers on download not help. beta link would be nice if fix problem . thanks did vaccine comp. just not usb yet.

  37. Omar
    December 9th, 2009 at 07:50 | #37

    thx for this tool
    I was in bad need for somthing like it
    I hope it will be benfit for me

  38. Jawad
    December 9th, 2009 at 16:52 | #38

    I clicked vaccinate usb and it took too much time because my cpu was busy so i removed the usb and now the usb is not detected by any cmputer. IT RUINED MY USB.

  39. PiETER
    December 10th, 2009 at 06:20 | #39

    With reference to below, I’m still waiting for feedback ????

    Hi I have selected to show all system files, on my memory stick I have a autorun.inf and a floder called zolander. If I format the stick then the files reappear when you refresh, your usb vaccine says the stick is vaccinated and does not pick up the autorun.inf file as a virusPlease can you assist>

  40. Jose
    December 10th, 2009 at 16:26 | #40

    Great solution to the nasty autorun.inf bugs, but …

    1. I’m still having a little bit of trouble with the vaccination process.
    This is due to having other antivirus softwares (trendmicro) that block user access to usb pens… The workaround was to unload TM and then it worked.

    2. Hoping to see any “settings” menu …

  41. Paulo
    December 10th, 2009 at 23:56 | #41

    this a message when run the ‘USB VACCINE” : exception processing message c0000a3 parameters 75b3bf7c 4 75b3bf7c 75b3bf7c

    Cancelar tentar novamente continuar

  42. Jo
    December 11th, 2009 at 06:11 | #42

    Autorun.inf file is an application file embedded into your memory stick, its no threat to Panda, this file outo opens your memory files for you to access more with ease. it cant be deleted its emabedded into its ‘fixed startup memory’.chow@PiETER

  43. Pieter
    December 11th, 2009 at 12:43 | #43

    After posting a problem here and still waiting for response i Feel that this place to post problems is a total waste of time you can simply look at the posts and the fact there is zero response. PANDA SOFTWARE I AM REALLY DISAPPOINTED !!!!

  44. Pinco Pallaccio
    December 13th, 2009 at 16:35 | #44

    Nice tool, but the technique used to “permanently” vaccinate USB pen drives, since v1.0.1.4 (before this version, it used the autorun.inf folder + reserved names like LPT1), involves a risky operation, i.e. direct editing of the FAT tables, described here: http://www.autoitscript.com/forum/index.php?showtopic=94076.
    Be careful…

  45. Ufuk ARSLAN
    December 13th, 2009 at 17:54 | #45

    1 – I want to choose icon files

    ICON=ICON.ICO

    2 – I want to give name to Usb Drive

    LABEL=SANDISK

    3 – Panda folder can be create in Usb Drive & include Scanner.exe

    Scanner.exe = Your USB Drive Viruses Scanner & Cleaner File

    4 – When i plugin USB Drive there can be a part which i can choose with clicking right mouse.

    shell\Panda=Scan with Panda USB Vaccine
    shell\Panda\command=Scanner.exe

    Example:
    hxxp://rapidshare.com/files/320372917/1.rar.html

  46. December 14th, 2009 at 09:49 | #46

    Thank you so much for this!!! I’ll blog this one :)

Comment pages
1 3 4 5 76
Comments are closed.