Here's the autorun.ini file
[autorun] action=Open Files On Folder icon=icons\drive.ico shellexecute=nircmd.exe execmd CALL batexe\progstart.bat Perhaps need to set it to scan .bat files at well? And forgive me, but what is Eicar testing? From: Sam Cayze [mailto:[EMAIL PROTECTED] Sent: Thursday, April 03, 2008 11:00 hrs To: NT System Admin Issues Subject: RE: USB usage protocols Scanning and the real-time filters use a totally different set of configurations. What is the extension of the program that executes? It that somehow excluded? Can you mimic the same results with Eicar testing? From: Christopher J.. Bosak [mailto:[EMAIL PROTECTED] Sent: Thursday, April 03, 2008 10:31 AM To: NT System Admin Issues Subject: RE: USB usage protocols Added note, when told to scan the folders / archive where the program is stored in, THEN it finds it. But until then, it does nothing. Chris From: Christopher J.. Bosak [mailto:[EMAIL PROTECTED] Sent: Thursday, April 03, 2008 10:27 hrs To: NT System Admin Issues Subject: USB usage protocols Okay, so it's come through the grapevine that someone is walking around with a USB drive that has USBThief running on it. I got a copy of the program, and it grabs passwords and whatever other information it thinks is useful and copies it to the drive and then you remove it. All this, with nothing showing up on the screen. Now, we're running NOD32, and I tested it, and it worked, and NOD did nothing. Has anyone run into this at all? Is the only option to disable the USB ports? Thanks in advance. Chris ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
