Is it possible for viruses to use Windows\' autorun.inf mechanism to start their

Question

Is it possible for viruses to use Windows' autorun.inf mechanism to start their execution? If so, is placing an autorun.inf folder a good safety precaution? My reasoning is that it can help in one fo two ways:

- Best case scenario, the virus cannot write its own autorun.inf file because it is blocked by the folder.
- Worst case scenario, the virus deletes the folder and replaces it with its own autorun.inf file. The drive is now infected, but at least you can notice the folder is missing and you are aware of it.

Explanation / Answer

Well, it might help. Better yet, make your computer not to obey autorun.inf on removable drives (but assuming you plug your usb into another -infected- system, it can help noticing it).

There is a solution taking the next step, USB Vaccine, which creates a unwriteable, undeletable file with that name in your usb drive. It does so by marking it with some extra bits at low-level, so the normal fs aren't able to remove it (the program can uninstall it, of course). Virus are very unlikely to go down at such level just to remove an autorun.inf

But regardless of that, disable its execution. And remember that there are more ways of getting infected via usb than due to an autorun.inf.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.