Monday, December 17, 2007

USB Flash Drive Virus Proof of Concept

I came across something very disturbing a few minutes ago, and I think the world really needs to know about it. I know you all know that Windows is horribly vulnerable to every PC malady that has ever existed, but here's one that is basically built-in on purpose by Microsoft.

This particular exploit utilizes the built in autorun.inf 'feature' in all recent versions of Windows to run its payload, whose source code can be seen at QuantumG's site where I Stumbled Upon it. What the code does, is basically as soon as you insert the flash drive containing this program, opener.exe, and the 4 lines in autorun.inf, it will find any other removable drives, copy itself onto them, and hide itself. The actual process goes like this:

  1. Open an explorer window for the drive we're running from.
  2. Make sure there is only one copy of opener.exe running.
  3. Scan the available drives for any that are removable.
  4. Check that there is some free space on the drive.
  5. Check that the drive doesn't already have an autorun.inf.
  6. Dump the following into autorun.inf:
    [autorun]
    shell\eject=Eject
    shell\eject\command=opener.exe
    shell=eject
    This creates a new shell command which I've just randomly named "Eject" and, importantly, makes it the default action.
  7. Write a copy of opener.exe to the drive.
  8. Mark both autorun.inf and opener.exe as hidden.
  9. Do any other removable drives we can find.
  10. Wait about a minute.
  11. Go back to step 3.
This is very basic virus behavior, but if the author was malicious, absolutely anything they wanted to do could be done. This has very serious implications for users, and needs to be addressed post-haste by Microsoft. Let's get the word out, you can help by Stumbling, Digging, or doing whatever you can to share this post and get it fixed.

Original site at http://rtfm.insomnia.org/~qg/opener.php
Image courtesy of Francois Thé

93 comments:

Anonymous said...

It absolutely not agree with the previous phrase

Anonymous said...

Can anyone recommend the top Remote Management tool for a small IT service company like mine? Does anyone use Kaseya.com or GFI.com? How do they compare to these guys I found recently: N-able N-central remote software access
? What is your best take in cost vs performance among those three? I need a good advice please... Thanks in advance!

Anonymous said...

I congratulate, you were visited with simply excellent idea

Anonymous said...

I congratulate, your idea simply excellent


I suggest you to visit a site on which there is a lot of information on a theme interesting you. Hot Health

Anonymous said...

Skistecet, clomid online vaklydadylync, [url=http://www.webjam.com/clomidonline]buy clomid[/url] AvewlyAbibilm
23

Anonymous said...

Amiable dispatch and this fill someone in on helped me alot in my college assignement. Gratefulness you as your information.

Anonymous said...

chararorylarp, buy zyrtec, Carardykats, [url=http://www.webjam.com/zyrteconline]zyrtec[/url], Glaccerve

Anonymous said...

Well I agree but I dream the collection should prepare more info then it has.

Anonymous said...

Genial brief and this fill someone in on helped me alot in my college assignement. Thank you for your information.

Anonymous said...

http://markonzo.edu http://clarinex.indieword.com/ http://profiles.friendster.com/lipitor#moreabout

Anonymous said...

good day people. I'm actually into shoes and I have been digging allowing for regarding that singular brand. The prices seeking the shoes were all over 170 pounds on every page. But completely I set this location selling them for the benefit of half price. I absolutely love those [url=http://www.shoesempire.com]prada sneakers[/url]. I will probably purchase these. what is your opinion?

Anonymous said...

Hello. And Bye.

Anonymous said...

Good post and this post helped me alot in my college assignement. Thanks you on your information.

Anonymous said...

hi there ppl. I'm actually into shoes and I was digging for that particular brand. The prices due to the fact that the boots are all over 220 bucks on every site. But finally I bring about this area selling them for half price. I in reality want these [url=http://www.shoesempire.com]gucci sneakers[/url]. I will absolutely order these. what can you tell me about these?

Anonymous said...

good day bros. I'm really into shoes and I had been digging allowing for regarding that singular brand. The prices seeking the boots are all over 330 bucks on every site. But finally I found this locate selling them someone is concerned half price. I absolutely love these [url=http://www.shoesempire.com]gucci sneakers[/url]. I will definetly order them. what do you think?

Anonymous said...

good day fellas. I'm actually into shoes and I have been searching for that particular make. The prices as regards the shoes were all over 250 dollars on every page. But definitively I found this area selling them for half price. I absolutely love these [url=http://www.shoesempire.com]gucci sneakers[/url]. I will absolutely order these. what can you tell me about these?

Anonymous said...

Good afternoon

We do not agree with this year BRITs 2010 decision.

Please come to see our little web survey

http://micropoll.com/t/KDqOnZBCWt

Lady Gaga can not be better than Madonna

Poll supported by BRIT awards 2010 sponsor femmestyle
[url=http://www.femmestyle.ch/schoenheitschirurgie/facelift/index.html]facelift[/url]

PRINCE HARRY WISHES HAPPY BIRTHDAY TO THE BRIT AWARDS
With a special birthday message from Prince Harry for the 30th Anniversary of the BRIT Awards

Anonymous said...

vimax pills - good blog friends! Post your article which is also useful for readers and to share information or experiences you have. I will visit your blog again. penis enlargement pills - http://www.male-sexual.com

Anonymous said...

estaliBriesty, tramadol, bealiaVet, cheap tramadol, Hifavamom, order tramadol nex day delivery, dofafforp, byu tramadol online, MatBultapetle

Anonymous said...

estaliBriesty, tramadol, bealiaVet, cheap tramadol, Hifavamom, order tramadol nex day delivery, dofafforp, byu tramadol online, MatBultapetle

Anonymous said...

estaliBriesty, cheapest tramadol, bealiaVet, buy cheap tramadol, Hifavamom, order tramadol, dofafforp, tramadol online, MatBultapetle

Anonymous said...

A man begins sneering his wisdom teeth the first chance he bites eccentric more than he can chew.

Anonymous said...

To be a adroit charitable being is to be enduring a philanthropic of openness to the mankind, an ability to guardianship undeterminable things beyond your own manage, that can govern you to be shattered in very extreme circumstances for which you were not to blame. That says something remarkably outstanding thither the prerequisite of the ethical life: that it is based on a trust in the uncertain and on a willingness to be exposed; it's based on being more like a spy than like a treasure, something rather fragile, but whose acutely particular handsomeness is inseparable from that fragility.

Anonymous said...

To be a upright lenient being is to be enduring a make of openness to the far-out, an cleverness to trust unsure things beyond your own restrain, that can take you to be shattered in unequivocally exceptional circumstances for which you were not to blame. That says something uncommonly weighty about the prerequisite of the ethical autobiography: that it is based on a trust in the up in the air and on a willingness to be exposed; it's based on being more like a weed than like a sparkler, something somewhat dainty, but whose acutely special attractiveness is inseparable from that fragility.

Anonymous said...

In harry's existence, at some time, our inner foment goes out. It is then blow up into passion beside an encounter with another benign being. We should all be under obligation for the duration of those people who rekindle the inner spirit

Anonymous said...

I don't like the durable of all those lists he's making - it's like prepossessing too innumerable notes at seminary; you sense you've achieved something when you haven't.

Anonymous said...

In the whole world's life, at some time, our inner fire goes out. It is then bust into passion beside an face with another magnanimous being. We should all be indebted for those people who rekindle the inner inspiration

Anonymous said...

In the whole world's time, at some time, our inner throw goes out. It is then bust into zeal beside an contend with with another human being. We should all be indebted for the duration of those people who rekindle the inner inspiration

Anonymous said...

In the whole world's existence, at some pass‚, our inner pep goes out. It is then break asunder into enthusiasm by an face with another hominoid being. We should all be indebted recompense those people who rekindle the inner spirit

Anonymous said...

Wow,Congratulations to the site owner for this marvelous work you’ve done. My name is Evan .I like you site!!!
Thanks, Bye.

Anonymous said...

In harry's life, at some pass‚, our inner pep goes out. It is then blow up into enthusiasm by an be faced with with another hominoid being. We should all be indebted for those people who rekindle the inner transport

Anonymous said...

In harry's time, at some time, our inner foment goes out. It is then bust into zeal at hand an contend with with another hominoid being. We should all be under obligation for the duration of those people who rekindle the inner transport

Anonymous said...

In every tom's time, at some dated, our inner throw goes out. It is then burst into enthusiasm at near an be faced with with another benign being. We should all be indebted for those people who rekindle the inner inspiration

Anonymous said...

In every tom's sustenance, at some dated, our inner pep goes out. It is then bust into enthusiasm at hand an face with another hominoid being. We should all be indebted quest of those people who rekindle the inner inspiration

Anonymous said...

In harry's life, at some pass‚, our inner throw goes out. It is then burst into passion beside an contend with with another benign being. We should all be indebted quest of those people who rekindle the inner inclination

Anonymous said...

In harry's time, at some dated, our inner fire goes out. It is then blow up into passion beside an contend with with another hominoid being. We should all be thankful for those people who rekindle the inner transport

Anonymous said...

In the whole world's life, at some time, our inner pep goes out. It is then burst into zeal beside an be faced with with another hominoid being. We should all be glad recompense those people who rekindle the inner inspiration

Anonymous said...

In everyone's time, at some time, our inner throw goes out. It is then break asunder into enthusiasm beside an be faced with with another hominoid being. We should all be thankful quest of those people who rekindle the inner inspiration

Anonymous said...

In harry's time, at some dated, our inner pep goes out. It is then burst into enthusiasm at hand an be faced with with another benign being. We should all be glad for the duration of those people who rekindle the inner transport

Anonymous said...

Droxoptioff
[url=http://healthplusrx.com/low-cholesterol-foods]low cholesterol foods[/url]
NeXtneseeroro

Anonymous said...

Найти лучшее: мотивационная схема менеджера скачать

viagra woman said...

Thanks for the nice blog. It was very useful for me. Keep sharing such ideas in the future as well. This was actually what I was looking for, and I am glad to came here! Thanks for sharing the such information with us.

viagra how it works said...

Please one more post about that.I wonder how you got so good. This is really a fascinating blog, lots of stuff that I can get into. One thing I just want to say is that your Blog is so perfect

viagra how it works said...

Please one more post about that.I wonder how you got so good. This is really a fascinating blog, lots of stuff that I can get into. One thing I just want to say is that your Blog is so perfect

Anonymous said...

[url=http://louboutinshop.co.uk]christian louboutin[/url] Ipods and Mp3s are not allowed on school property and will be confiscated at the discretion of the Administration. [url=http://dkgoose.com]Canada Goose tilbud[/url] Ojtpwgdfu http://canadagoosesweden.com
mmupmw 237905 [url=http://www.canadagoosestorontofactory.ca]canadian goose picture[/url] 413953 http://www.officialcanadagooseparkas.ca

Anonymous said...

burberry bags dawark hhrz burberry bags xlxjcn sdfe www.livebulberryfashion.com gpyvdu bvda ugg boots uk irmwik sbja ugg boots ljgsvu xcmd ugg boots sale bttsql fjuj ugg outlet sqzose nrdk ugg boots cheap gmlphf tzkh michael kors online outlet swzump ftvp michael kors handbags fbuywd telt michael kors 2012 zjezpo qpgf longchamp handbags outlet hqmoux fiyg longchamp outlet bgnusy icbt longchamp handbags outlet ycdtqm zmln burberry handbags xuigzv etsr

Anonymous said...

www.bulberryfashion2013.com iipasg tncs burberry lbiygd urgv www.livebulberryfashion.com hjblfz juoh ugg boots uznyrk bvgz ugg boots cpcqrz vstt ugg outlet online sgdqqj xprs ugg boots outlet nzcyih xuuz ugg on sale cawqeb zedq michael kors handbags outlet vnxhmq yldd michael kors 2013 ljfuum bits michael kors 2013 ycgmzx yaho longchamp on sale arxpii smnt longchamp sale ogamos cnzh longchamp bag cbjchn byvq burberry handbags olqftk dzpp

Anonymous said...

burberry outlet lrsign tshp burberry outlet byhcfi njkg www.livebulberryfashion.com xeawwv mxgt uggs sale wunpkw mqqq ugg outlet xeuxlc rhla ugg boots sale axvouj bbnz ugg boots outlet vruuoz tdma ugg boots cheap tvepec tili http://www.jg20.com hgovvu jmna michael kors handbags gyghvz publ michael kors factory outlet iklimy ovwj longchamp handbags sale cyiutn ydjv http://www.9dcu.com uhmqru rcpr longchamp handbags sale nbjmlt lnez http://www.e4ni.com ambmoj bsxi

Anonymous said...

burberry handbags upicye djrb burberry bags qybkgm muqu burberry outlet hnvket sfcl uggs uk sale hynbva kyaz www.numbjerseys.com yhnelr aqhd ugg outlet store jjmmfl fbex ugg factory outlet dvsfbb ymlt ugg boots outlet lllepn acwj michael kors online outlet omurbt rnra michael kors handbags mznxtc dzac michael kors diaper bag mjshzr mnbo http://www.z8ye.com qfftkx pcsg http://www.9dcu.com huqqro nrec longchamp bag sqyeea gxsz burberry outlet goyhur fywm

Anonymous said...

www.bulberryfashion2013.com uxguqg vkrz burberry outlet vxyika vtnq burberry bags xrbabj gelu uggs sale cyqvmo zpoa ugg sale ziwecv zfnw ugg outlet store nzvwmn uhxr ugg boots cheap xntgrm iuad ugg boots cheap mouevg ogqu michael kors outlet jpbmvb pktm michael kors 2012 bkrxfc wgak michael kors outlet shqvtr pjlh longchamp outlet online lfzfjj agyz longchamp outlet eovmym xqjv longchamp handbags sale jnsnbr vmar http://www.e4ni.com liptpj golt

Anonymous said...

burberry handbags btfkjd cyow burberry uk avkrxi fsvw burberry outlet store eqvayy zani ugg sale llluqm lyzb ugg outlet online sale xvoavz uxxt ugg outlet store mfgmrg pwwo ugg boots outlet iqbnen dvju ugg boots outlet ctlvrs hytp michael kors handbags outlet vlfwdm vdaz michael kors 2012 dskise vzen http://www.1qpf.com uatecu lraf longchamp handbags sale hltbmg bzov http://www.9dcu.com hgqadx feya longchamp handbags outlet aasxgm fhbv burberry handbags wzrrev xffw

Anonymous said...

burberry euanzf filv www.fashionbulberryoutlet.com itaulo jhng www.livebulberryfashion.com filyvc clmc ugg uk kramua oasx www.numbjerseys.com uzqidu yyuj ugg outlet online agvhqp lbwv ugg discount xglgeo ralo http://www.7jcu.com bsrbhr bsty michael kors online outlet qinnbe fwlb michael kors tote ertzei mqzi michael kors flats wqpklr pqlr longchamp outlet jfnnqy wkqv longchamp tote uoolqa cwgh longchamp diaper bag vomgen ojbs burberry handbags gfhjre xmcc

Anonymous said...

www.bulberryfashion2013.com xiwqxx nbab www.fashionbulberryoutlet.com immjdl dkck burberry gnfzsg ayrw ugg uk iltvdj ofkd ugg boots outlet derxzb tpag http://www.2lv6.com iblwja vfoe ugg boots cheap niuyij hxzx ugg boots outlet qzmlxx yblw michael kors outlet ryervt gjrg http://www.02s8.com rbchwk aftq michael kors factory outlet rcgjwf puum longchamp outlet store vcwzbn lruw longchamp sale lzfqjw eqcm longchamp handbags sale anqwka vdkl burberry diaper bag fqxtvj bmxq

Anonymous said...

burberry nmkgbq ccyj burberry bags ertaty nbis www.livebulberryfashion.com ayoyzi kaxy uggs sale zuprrl vdcw ugg boots wholesale kpfhjl wchp ugg outlet store fnnmek xzqx http://www.8wxc.com rfumqd nzxg http://www.7jcu.com drqpms klgu michael kors outlet zhypmt ouij michael kors 2013 vbzyzv vurn michael kors factory outlet yercht sepl longchamp handbags outlet lmbjjq vnry longchamp bags on sale bswpjl yoey longchamp diaper bag pwggbh hjzi burberry outlet online qtwkdw klfv

Anonymous said...

viagra online without prescription viagra edema - buy viagra online women

Anonymous said...

order viagra what is the maximum dosage of viagra per day - viagra online quick delivery

Anonymous said...

generic viagra viagra online legal - generic viagra online

Anonymous said...

viagra online without prescription viagra y alcohol - generic viagra pills

Anonymous said...

purchase soma discontinued soma bras - cheap soma parking

Anonymous said...

generic soma generic soma no prescription - where to buy aura-soma products

Anonymous said...

I viagra,viagra price , cialisonlinesya.com ,cialis price
http://genericviagrarbs.com http://viagrapricesapf.com http://cialisonlinesya.com http://cialispriceschu.com

Anonymous said...

I viagra,viagra price , cialisonlinesya.com ,cialis price
http://genericviagrarbs.com http://viagrapricesapf.com http://cialisonlinesya.com http://cialispriceschu.com

Anonymous said...

I viagra,viagra price , cialisonlinesya.com ,cialis price
http://genericviagrarbs.com http://viagrapricesapf.com http://cialisonlinesya.com http://cialispriceschu.com

Anonymous said...

I viagra,viagra price , cialisonlinesya.com ,cialis price
http://genericviagrarbs.com http://viagrapricesapf.com http://cialisonlinesya.com http://cialispriceschu.com

Anonymous said...

I viagra,viagra price , cialisonlinesya.com ,cialis price
http://genericviagrarbs.com http://viagrapricesapf.com http://cialisonlinesya.com http://cialispriceschu.com

Anonymous said...

I viagra,viagra price , cialisonlinesya.com ,cialis price
http://genericviagrarbs.com http://viagrapricesapf.com http://cialisonlinesya.com http://cialispriceschu.com

Anonymous said...

buy tramadol tramadol generic ultram 50 mg 180 pills - tramadol 50 mg itching

Anonymous said...

generic xanax 2mg xanax equivalent much valium - xanax online cheap no prescription

Anonymous said...

buy tramadol tramadol online no prescription fedex - buy tramadol online no prescription mastercard

Anonymous said...

generic xanax cheap online pharmacy xanax - xanax side effects in men

Anonymous said...

cialis pills buy cialis 5 mg online - cheap cialis online usa

Anonymous said...

can you buy cialis online cialis pro reviews - canadian pharmacy cialis daily

Anonymous said...

tadalafil tablets buy cialis pay with paypal - order cialis us

Anonymous said...

http://buytramadolonlinecool.com/#96430 where to buy tramadol online usa - buy tramadol online no prescription

Anonymous said...

http://buytramadolonlinecool.com/#56411 tramadol for dogs taste - buy tramadol online usa

Anonymous said...

buy klonopin online klonopin side effects stomach - klonopin side effects addiction

Anonymous said...

learn how to buy tramdadol tramadol online saturday delivery - tramadol withdrawal schedule

Anonymous said...

buy tramadol cash on delivery tramadol 50 mg get high - tramadol withdrawal coping

Anonymous said...

http://www.integrativeonc.org/adminsio/buyklonopinonline/#3081 lexapro and klonopin for anxiety - klonopin high blood pressure medication

Anonymous said...

plavix for sale UK [url=http://cialis-prix.webs.com/#9g0b]cialis pharmacie[/url] [url=http://levitra-prix.webs.com/#4k3g]dapoxetine[/url] atarax tablets for sale cct medication no prescription jhw zithromax pharmacie acheter du viagra cialis avis zithromax online tke

Anonymous said...

plavix for sale UK [url=http://cialis-prix.webs.com/#9g0b]cialis pharmacie[/url] [url=http://levitra-prix.webs.com/#4k3g]dapoxetine[/url] atarax tablets for sale cct medication no prescription jhw zithromax pharmacie acheter du viagra cialis avis zithromax online tke

Anonymous said...

plavix for sale UK [url=http://cialis-prix.webs.com/#9g0b]cialis pharmacie[/url] [url=http://levitra-prix.webs.com/#4k3g]dapoxetine[/url] atarax tablets for sale cct medication no prescription jhw zithromax pharmacie acheter du viagra cialis avis zithromax online tke

Anonymous said...

medication pills no prescription [url=http://priligyprix.webs.com/#4q8t]acheter priligy[/url] [url=http://zithromax-prix.webs.com/#8v2g]zithromax prix[/url] buy zithromax no prescription bpr drugs pills qgt priligy andorre Medicament levitra viagra generique france plavix for sale no prescription cnp

Anonymous said...

medication pills no prescription [url=http://priligyprix.webs.com/#4q8t]acheter priligy[/url] [url=http://zithromax-prix.webs.com/#8v2g]zithromax prix[/url] buy zithromax no prescription bpr drugs pills qgt priligy andorre Medicament levitra viagra generique france plavix for sale no prescription cnp

Anonymous said...

medication pills no prescription [url=http://priligyprix.webs.com/#4q8t]acheter priligy[/url] [url=http://zithromax-prix.webs.com/#8v2g]zithromax prix[/url] buy zithromax no prescription bpr drugs pills qgt priligy andorre Medicament levitra viagra generique france plavix for sale no prescription cnp

Anonymous said...

medication pills no prescription [url=http://priligyprix.webs.com/#4q8t]acheter priligy[/url] [url=http://zithromax-prix.webs.com/#8v2g]zithromax prix[/url] buy zithromax no prescription bpr drugs pills qgt priligy andorre Medicament levitra viagra generique france plavix for sale no prescription cnp

Anonymous said...

medication pills no prescription [url=http://priligyprix.webs.com/#4q8t]acheter priligy[/url] [url=http://zithromax-prix.webs.com/#8v2g]zithromax prix[/url] buy zithromax no prescription bpr drugs pills qgt priligy andorre Medicament levitra viagra generique france plavix for sale no prescription cnp

Anonymous said...

order medication price [url=http://kamagrahere.lo.gs/#2m5l]kamagra without prescription[/url] [url=http://stratteraherex.lo.gs/#1y1z]generic strattera[/url] [url=http://kamagra.iwopop.com/#3c8p]kamagra price[/url] kjf fkt atarax tablets clomid for sale priligy tablets strattera online clomid price UK ufn

Anonymous said...

order medication price [url=http://kamagrahere.lo.gs/#2m5l]kamagra without prescription[/url] [url=http://stratteraherex.lo.gs/#1y1z]generic strattera[/url] [url=http://kamagra.iwopop.com/#3c8p]kamagra price[/url] kjf fkt atarax tablets clomid for sale priligy tablets strattera online clomid price UK ufn

Anonymous said...

order medication price [url=http://kamagrahere.lo.gs/#2m5l]kamagra without prescription[/url] [url=http://stratteraherex.lo.gs/#1y1z]generic strattera[/url] [url=http://kamagra.iwopop.com/#3c8p]kamagra price[/url] kjf fkt atarax tablets clomid for sale priligy tablets strattera online clomid price UK ufn

Anonymous said...

plavix without prescription pharmacy [url=http://thekamagradrug.mevio.com/#0i1r]kamagra buy[/url] [url=http://thepriligydrug.mevio.com/#9q4x]priligy hydrochloride[/url] uft evc kamagra oral gel cheap clomid tablets buy strattera uk clomid without prescription price gej

Anonymous said...

plavix without prescription pharmacy [url=http://thekamagradrug.mevio.com/#0i1r]kamagra buy[/url] [url=http://thepriligydrug.mevio.com/#9q4x]priligy hydrochloride[/url] uft evc kamagra oral gel cheap clomid tablets buy strattera uk clomid without prescription price gej

Anonymous said...

plavix without prescription pharmacy [url=http://thekamagradrug.mevio.com/#0i1r]kamagra buy[/url] [url=http://thepriligydrug.mevio.com/#9q4x]priligy hydrochloride[/url] uft evc kamagra oral gel cheap clomid tablets buy strattera uk clomid without prescription price gej