Microsoft- Please read!

[ahhaa]

The growing malware threat via USB is having real consequences, including messing with our military overseas:

Under Worm Assault, Military Bans Disks, USB Drives
http://blog.wired.com/defense/2008/11/army-bans-usb-d.html

Its been going on for over a year, as shown here:
Malware found on new hard drives
http://blogs.zdnet.com/hardware/?p=928

Even Roel Schouwenberg, a senior anti-virus researcher for Kaspersky, can only beg Redmond to fix this:
Is there no end to the AutoRun madness?
http://blogs.zdnet.com/security/?p=2235

imho, it seems to me the fix already exists, if you'd just impliment it...

a. a basic right mouse button feature is 'scan this'.
b. when a particular USB device, such as a flash drive, is plugged in, Windows opens a list of 'what do you want to do?'
Which does not include 'scan this device'.
Just add the pre-existing scan ability to this list!

There is also the option to 'always do this action'. That would make sure you never forgot, no matter where your drive had been in the meantime. And if the user didn't want a scan, they could always cancel it.

whaddayathink?

[SCDVD]

If I were in the business of selling USB storage devices, I would be all over this issue. If it isn't dealt with, it will cause these companies to lose a lot of business because people will stop using these devices. I agree that Microsoft can help with Windows features that help with this problem but it will take more than some lonely soul on a forum posting about it to cause Microsoft to do anything about it.

In the near term, people can disable autorun so that the malware on these devices will not install themselves as a byproduct of merely plugging a USB storage device into a computer.

[yoda313]

does this apply to flash memory as well? I just bought a sd hc memory card that I'm going to give as a holiday present and I don't want to worry about it.

Or is this just for actual harddrives not flash memory?

[MOVIEGEEK]

does this apply to flash memory as well? I just bought a sd hc memory card that I'm going to give as a holiday present and I don't want to worry about it.

Or is this just for actual harddrives not flash memory?

This effects all drives,by installing TweakUI you can disable autorun on all drives.
You should always full format the drive before using,this will delete any malware.

[yoda313]

Thanks for the info.

[Ai Haibara]

To be honest, I'd thought most people would've turned Autoplay off by now, especially after the rootkit debacle a while ago. I guess it's just 'easier' to disallow all external/USB drives than change all those systems, especially if they're reset to a default image every day, or so.

Maybe Microsoft should have a Windows Update patch set Autorun defaulting to off.

[SCDVD]

To be honest, I'd thought most people would've turned Autoplay off by now, especially after the rootkit debacle a while ago. I guess it's just 'easier' to disallow all external/USB drives than change all those systems, especially if they're reset to a default image every day, or so.

Maybe Microsoft should have a Windows Update patch set Autorun defaulting to off.

Autoplay isn't so serious. It just plays media. Some might argue that even this isn't good and I wouldn't disagree. But the killer is Autorun because it will execute the autorun.inf file and run any program that it invokes. This is really dangerous.

[MOVIEGEEK]

Microsoft issued a patch last night that fixes the autorun bug on 2000,XP and 2003:
http://www.itworld.com/windows/63219/after-cert-warning-microsoft-delivers-autorun-fix

[lordsmurf]

I have autorun enabled but it always asks what I want to do, before it actually "runs" anything.

[JohnnyMalaria]

The company I work for has banned USB memory cards for years unless they are issued by the company.

Sorry, but if my company is more anal about security than the US military then I know where the problem lies. Permitting connection of private computers or external storage devices to a military network is rank stupidity. And it's more than 'messing with our military overseas'.

As for USB hard drives, the very first thing I do with one is reformat it to NTFS.