0

The question is clear, I'm a programmer and wrote a software to disinfect the USB devices when they got the malware which hides the files and creates a shortcut of the virus . Using this soft we can disinfect the data, But if the USB is replugged it'll get infected again ...

at this point I'm trying to prevent malwares from knowing when removable devices are plugged in, any ideas?

  • Uninstall the USB driver? – Philipp Feb 7 '14 at 21:39
4

Computers are not good at detecting evil. Meaning that you cannot make an automated test which can tell you if some software, which detects USB device plugging, is "malware" or "not malware".

As long as a machine:

  • currently runs malware (i.e. is subverted);
  • and can detect at all that a USB device is plugged;

then the malware can see the USB device and do everything that it wishes to do on it.

To prevent malware on a given machine from noticing that a USB device is plugged, then, you only have two possibilities:

  1. Remove the malware from the machine.
  2. Don't plug the USB device.

From your description, what you are trying to do is analogous to the following: when a hospital is on fire, how do we arrange for the flames not to notice when a new patient enters, so that the flames don't actually incinerate him ? This ridiculous metaphor is meant to illustrate the idea that you might be trying to solve the problem by the wrong end, with predictably suboptimal results.

| improve this answer | |
  • To prevent malware on a given machine from noticing that a USB device is plugged, then, you only have two possibilities: Remove the malware from the machine. Don't plug the USB device. why only this options ? in programming there is an event that notice you when a device is plugged in. when a hospital is on fire we can cover new patient's eye ,can't we ? ;) – Jafar Akhondali Feb 8 '14 at 19:03
  • @Black-Hole - Unfortunately, that requires that whatever you're covering the patient with not already be on fire. If a computer system is subverted, it's best to consider anything and everything suspect - that is, you can't restrict access to the notifications (reliably, if at all even normally). Essentially, your nursing staff is going to a closet for fire blankets, but isn't checking to see if they're on fire (or even just heated to human flash-point temperature) first. – Clockwork-Muse Feb 9 '14 at 2:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.