At present, U disk virus is incredibly significant, almost all U-disk using the virus,
Microsoft Office Professional Plus 2010, the basis directory has a autorun.inf. Even more right-click menu As we used to use double-click to open the disk, but now we double-click,
Office Professional Plus 2010, typically not open U disk, but to the procedures established by the autorun.inf within the automobile play. So for many individuals, fairly troublesome. In reality, the virus Autorun.inf You'll find four approaches using basic
OPEN = filename.exe immediately. XPSP2
But for a great number of people and Vista end users, Autorun has turn out to be AutoPlay,
Microsoft Office 2010 Key, don't automatically operate it, it'll pop-up window say that you simply must do.
shellAutocommand = filename.exe shell = Vehicle
modify the context menu. The default boot entry is replaced with the virus. But this time so long as the consumer right click on the icon and instantly found flaws. Smart virus will alter the default entry name, but if you find non-Chinese within the program proper out from the garbled menu much more or Chinese, you might believe what's it?
shellexecute = filename.exe
ShellExecute =.... just name ShellExecuteA / W function tries to open U root directory, the virus will run automatically. This is to deal with those that use Win + R who misplaced the opening generate.
shellopen = Open (& O) shellopenCommand = filename.EXE shellopenDefault = 1 shellexplore = Resource Manager (& X)
this confusion is greater, the emergence of a new form. Perfect menu 1 can not see the problem, but within the non-Chinese program, betrays itself. Suddenly appear garbled in Chinese of course, could not escape his stuff.
the face of this danger, specifically the fourth, rely solely on Explorer itself, has been difficult to determine whether the removable disk poisoning. In this case, some individuals according to their own experience, made the
immunization approach, on removable disks and hard drives
1, the same name as the directory
directory in Windows, is a special file, and two the same directory under the file can not be the same title. Then,
Office 2010 Product Key, create a directory
2, autorun.inf file title directory under the illegal
Some viruses joined the fault tolerance code is generated autorun.inf autorun.inf before you attempt to delete the directory. Under the Windows NT Win32 subsystem, such as directory query purpose is unable to query the contents of these directories will return an error. However, deletion with the directory should be progressively removed the entire tree under which, it will need to check the contents of each subdirectory under it. Therefore, within the You can find similar utilization of Native API to create the directory working with the DOS reserved identify (for example, con, lpt1, prn, etc.) can also achieve a similar purpose.
3, NTFS access control
hackers, virus writers also know Windows, these functions can be regarded as Bug. They can do a system scan the directory and found a directory title last byte is '.' Is by visiting the .
Therefore, even low-level file system based access control approach emerged. The U disk, mobile hard disk formatted as NTFS file system,
Windows 7 Key, create the Autorun.inf directory, set the directory for any customers do not have any authority, not only can not remove the virus, can not even list the directory contents. However, this approach is not suitable for music players and the like in most cases don't support the NTFS device.
These three steps than the step by step can be described as exciting. But the biggest problem is not how to prevent the formation of this autorun.inf, but rather the program itself, Explorer vulnerability. Virus writers will soon make a much more powerful system.