I have had an encounter with the paint virus and I noticed it infects OS files in order to target .exe files(it changes an original .exe file to a hidden OS file and renames with a 'v' before the initial name and then names a 899KB size of itself as the original .exe for the user to click).

I was able to get rid of it via my anti-virus (probably the part of it that got bound to my OS) but I wasn't able to undo all the renaming it did to all .exe files on my PC plus the tiny 899KB fakes. I finally wrote a script to delete and do a re-rename.

The other day I was trying to pick a file from a USB flashdrive and I saw the paint virus file (configured my file explorer to always show all hidden files including protected OS files) and permanently deleted it like any other file.

How did this hidden paint virus file hope to get itself copied or transferred to my system without being selected by me from the USB drive when copying other files from it suppose I didn't delete it?


1 Answer 1


Ultimately, there are actually multiple ways malware can spread through removable media:

Windows Autorun functionality.

Years back, when new software primarily came in the form of physical installation media, Microsoft decided that users shouldn't need to hunt through directory listings to find the installer when they put the media into their computer, and as a result, Autorun was born.

In short, if you have Autorun enabled (all consumer Windows systems do by default), whenever you connect some form of removable media to the system (be it a floppy disk, a CD, a DVD, a flash drive, or even something really exotic like a ZIP disk or Thunderbolt storage device), Windows will look for a file called autorun.inf in the top-level directory of the media. This file, if present, can do a number of interesting things. The simplest (and most common use) is to just change the icon for the removable media (usually to match whatever product it contains the installer for). However, it can also make Windows run a specific executable off of the media either when you try to open the media by double clicking the icon, or completely automatically. The most common legitimate use for this these days is USB devices which need special drivers (when you connect it, it looks like a USB flash drive to the system, which sees the Autorun file, which in turn points to an installer for the drivers for the device), but such devices are increasingly rare.

Because Windows doesn't always prompt the user about what to do with the Autorun file, and on top of that most users just click through without thinking (and even if they tell it not to run anything, it may still do so if they manually double click the icon for the media), this is a very popular vector for malware to spread.

Other OSes also have similar functionality, although it's usually turned off by default (or at least, not as trivially exploitable as the Windows Autorun functionality).

Malicious filesystem images.

This one is a bit more technical. Essentially, by carefully manipulating the filesystem on a device (often by hand with a hex editor), it's theoretically possible to exploit bugs in the filesystem drivers of the OS to do any number of things. This can be used to hide files from the user (making the above exploit harder to detect), or just to attack the system directly through some exploit in the drivers. This is not commonly exploited by most malware, but it's also really easy to do with some practice.

Malicious device firmware.

Even rarer than the other two possibilities, it'st technically possible for the firmware on a storage device to directly attack the system itself. This can be used to produce results like either of the above two options, or just attack some other part of the OS involved with interfacing with the storage device directly. This is almost exclusively limited to highly targeted attacks because pulling it off from software on an already infected system ranges from 'insanely hard' to functionally impossible', and is almost certainly not what happened here.

  • While Windows autorun for CDs used to be a default many years back, that has not been the case for a long time now unless you have a terribly misconfigured machine. USB Flash drives were never default configured to autorun. For a brief time there were a bunch of U3 thumb drives that would autorun by pretending to be two devices, one of which was a CD in order to perform the autorun capability. Oct 24, 2019 at 23:15
  • @user10216038 While that is true, the default is still to pop up a prompt about what to do with the media. If there's an autorun.inf file with a configured executable listed in it, that will be an option, so it just takes a bit of social engineering. Even ignoring that though, the autorun file always gets parsed by Windows (even if Autorun is completely off), and that can potentially be exploited multiple ways (for example, by using a WMF file with malicious code in it as an icon). Oct 25, 2019 at 1:17
  • I don't count anything that requires the user to give permission as that would apply to almost anything. Yes WMF used to be a viable attack, but was fixed years ago. Oct 25, 2019 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .