Ask Leo!

I found a USB thumbdrive, plugged it in and now my system won't work. What happened?

Home » Hardware » USB and 1394 Interfaces

Summary: USB Thumbdrives or flash drives are a non-obvious but easy way to spread malware. You should be quite careful when dealing with an unknown device.

One day I found a USB thumbdrive and I plugged into my computer. After that I couldn't do most of the stuff on my computer, I couldn't open Help and support center, run MSN, Yahoo messenger, other installed programs, system restore, Internet Explorer. Do I have malware or something of that sort?

Yes, I'll bet you do.

I wanted to address this question because it's not all that obvious to most people that plugging in an unknown USB device can be dangerous, to say the least.

And it's one of the reasons I almost always turn off "autoplay".

I vaguely remember an anecdote about a security test performed where USB thumbdrives were left outside around a corporation, as if they'd been mistakenly left behind somehow. Each was infected with some relatively benign malware that would alert some remote site that the drive had been picked up and inserted.

Something like over 50% of the thumbdrives were plugged in and their malware installed.

The lesson is clear: if you want to infiltrate a random corporation, put malware on a number of thumbdrives and drop them around the company's headquarters.

On the other hand, if you're that corporation, you want to make sure that at a minimum your employees are alert to the danger.

"Lesson: don't plug in thumbdrives ... that you're not certain of."

So what's happening here? What is that danger?

In a nutshell: autorun.

You've probably seen it: when you insert a CD-ROM, for example, quite often a program will run automatically. You'll typically see this in product setup CD-ROMs. Encoded on the CD-ROM are a couple of special files that say, in effect, "when the disk is inserted, run this program".

The same is true for USB thumbdrives. They, too, can have auto-run ability.

And to make matters worse, autorun can happen silently.

So it's very simple: a malware author simply creates a USB thumbdrive with malware, and sets it up to auto-run and install the malware silently when the thumbdrive is plugged in. You'd never know until you scanned for viruses or spyware or, as in your case, things stop working as they should.

Lesson: don't plug in thumbdrives (or any "removable media") that you're not certain of. Treat them just like downloads, if you can and at least scan them first.

So how do you scan them if you can't safely plug them in? Turn off auto-play. Once you've done that you can safely insert the device and examine its contents or run anti-malware scans.

Or you can just decide it's not worth the risk, and discard the drive. They're cheap these days, and a malware infestation can be pretty expensive.

Assuming you did decide to look, once you're satisfied that it's safe you can do whatever autoplay would have done by opening the file "autorun.inf" at the root of the drive in notepad and examining the "open=" line.

Most of the time that'll be a setup program, also at the root of the drive.

But as a rule of thumb (no pun intended), I disable auto-play on all my drives. Not only do I find auto-play often annoying, but as you can see there can be significant security risks if you're not careful.

Related:

More articles about: USB and 1394 Interfaces

Article Useful? Link to it from your own website; just copy/paste this HTML:

Article 12275 | Posted March 13, 2008

Recent Comments

Hey Leo,

That autorun article is great. But could you make one on how to disable autorun in Windows Vista for the Vista users.

Thanks Leo and keep up the great work.

Posted by: Dan Warrener at March 14, 2008 06:33 PM

Hi Leo,

Unfortunately this question didn't come early enough to put me on guard. What you're describing happened to me couple of weeks ago and gave me a Trojan Backdoor.win32.Rbot. Later I found the autorun file on my USB/Mp3. I'll try to disable autorun as you mentioned.

But CD-ROMS and DVDs are safe, aren't they? Malware can't launch from them... or am I mistaken?

Thanks

Posted by: 'Leo fan' at March 14, 2008 08:03 PM

Why would ANYBODY put a USB thumbdrive anywhere NEAR their computer if they didn't know what was on it??? The scabs that write all these viruses LIVE for people like that!

Posted by: Carl R. Goodwin at March 14, 2008 08:34 PM

Thankfully Vista won't autorun anything without first prompting.

more info: http://www.worldstart.com/tips/tips.php/3732

Posted by: Chris Buechler at March 15, 2008 11:26 AM

To "Leo fan":

Of course malware can be launched from CDs and DVDs, if there is malware on the media.

Use your favorite search engine and look up "sony rootkit" for a rather infamous example.

Posted by: Ken B at March 17, 2008 10:09 AM

Post a comment on "I found a USB thumbdrive, plugged it in and now my system won't work. What happened?":






(Email Address will not be published.)

Remember Me?

By popular demand...
my tip jar
Cuppa Joe
Buy Leo a Latte!


New!

RSS feed Subscribe to the RSS Feed specifically for comments on this article.

Before commenting, please...

Please wait. Your comment is being processed ...

Ask Your Question:


ask-leo.com
Web

Archives

By Category
By Date

Advertisers

Advertise on Ask Leo!

««   »»

Question? - Ask Leo!
Who is Leo?
Link to Leo!

Terms, Conditions & Privacy