USB Flash drives and viruses

Asha'man X

Expert Member
Joined
Aug 31, 2006
Messages
1,401
Hi everyone

I would post this under the Internet Security forum, but it doesn't get as exposed as this forum so I thought I'd ask here.

What do you do to control viruses and spyware and other nasties on flashdisks on your networks? Lately, there's been a flood of staff members disks being infected with all sorts of nasties. One person had 1500 infections of the Fujacks worms over his 2 drives. And they will keep replicating because wherever he is using the disk outside of the school is infected badly.

I was reading on the Comodo forums that this seems to be a very new and serious threat, and they provided links to some sites that showed how to use a flashdisk to hijack a computer by simply plugging the drive in and getting the user to open or explore the drive. Some anti-virus packages won't even pick up the threat until it's too late.

The problem is that there is no control once the staff or student uses the disk outside of the school. You cannot tell the state of the computer on which they will use the drives. An internet cafe, home computer, friend's computer, it's too easy to get infected.

Does anyone use third party software to manage allowed and disallowed USB connections? A policy statement that everyone must sign and adhere to? I'd appreciate any ideas or real life examples from anyone who has a working setup.

Thanks :)
 

Deenem

Expert Member
Joined
Apr 20, 2005
Messages
1,724
If you're using XP or Vista you can use the Group Policy editor to disable external drives.

Google 'disable USB drives Group Policy'
 

Asha'man X

Expert Member
Joined
Aug 31, 2006
Messages
1,401
@ Deenem

Thanks for the tip, I did just that and have found some good interesting articles. Unfortunately it doesn't quite help me, as I can't disable the flash drives. People use it for backups, personal documents, and when it comes to school reports, they use the drive to take their Excel marksheets home.

Disabling autorun may help, it would give the anti-virus package time to scan the drive.
I'm also in the stages of planning a vendor change to NOD32.
 
Top