IAM Flash Shield - Active Protection Against Removable Drive Viruses

Recently, I released a cleanup program for viruses that spread itself through USB Flash Drives. At the moment, it only has 2 signatures – the 2 variants of the Aikelyu virus. I would add more when I get my hands on more specimens.

I am a bit surprised how widespread these infections are. I would attribute that to the increasing popularity USB Flash Drives and how easily new variants and imitations can be created. Anti-virus companies will definitely have a hard time catching up. As a matter of fact, some popular anti-viruses still can’t detect some of them. Or maybe, they just choose to ignore them. These viruses after all are more of an annoyance rather than a threat to data integrity.

I am a firm believer of the saying “Prevention is better than cure.” Rather than having the most comprehensive cleaner for every single flash drive virus out there, it’s better not get yourself infected at all. The preventive steps to manually detect and delete these viruses are simple. However, over time they can be drag.

And so, I spent the weekend building a simple utility to detect viruses lurking in your usb flash drive. It’s usually just there waiting to be activated when you use autoplay or by double clicking the drive’s shortcut in My Computer. It is an indiscriminate scan. Whenever autorun.inf points to a script or executable, it will prompt you if you recognize the script or the program. If you don’t recognize it, clicking yes would delete it. If it doesn’t find any it will prompt you that it didn’t so you can safely start using your removable drive.

There’s only a few hours of work built into this utility so don’t expect amazing stuff. But it does the job. Scans are done on program startup and every time you insert a removable drive in the computer. During first run, it will also lodge itself on the startup programs list so that it gets activated every time you log in to our computer.

In the future, I will add more functionality by integrating IAM Flash Clean. Maybe an auto updater. Or maybe you can make suggestions in the comments below. Hopefully, I have enough free time to do all that.

I called it IAM Flash Shield. You may download this active resident protection against removable usb flash drive viruses here.

IAM Flash Shield

Note: This software is offered to you FREE, "AS IS" and without any warranties. Use at your own risk.

IAM Flash Shield 1.01

Features:

- Scans Removable / USB Flash Drives for hidden programs / scripts in autorun.inf
- Prompts for user action when a possible virus is found.
- Automatically detects newly inserted removable / usb flash drives.
- Automatically scans removable /usb flash drives when this program starts.
- Prompts user if removable / usb flash drive is safe to use.
- Starts automatically on Windows logon (This software adds itself to Startup Programs).

Requirements:

This software is written using the .Net Framework 2.0. Download and install before using this software.


Instructions:

1. Download the software by click the link above.
(Don't use a download manager. Files are small anyway.)
2. Unzip to any folder.
3. Double click IAMFlashShield.exe. An icon will appear on your task bar to show that it is running.

Flash Drive Viruses (Aikelyu / deadly-c.vbs / pooh.vbs)

Flash drive based viruses have been on the rise recently. Most are harmless but no less annoying. I do get exposed to a lot personal computers as my job requires me to do onsite maintenance of my programs. I get exposed to them a lot and even got infected once.

Sadly, most of these seem to have been written by fellow Filipinos (or at least some variants) and most occurrences seem to be localized here in the Philippines. This probably explains why these escape the eyes of some large anti-virus companies.

The most recent one I’ve encountered is Deadly-c.vbs. It seems like a variant of the Aikelyu virus. Looking around the internet, it also occurs as pooh.vbs. It propagates itself in all writable drives except the floppy disk and during windows startup it calls Internet explorer and shows an html file containing the irritable words “f%%k you-->this is jayker felling----->PogitosGwaposAmigosGarantisadosGalantis Kaayos!!”.

This time I finally decided to deal with it. I’m a VB programmer myself and this one being written in vbscript I can read and look at what it does. So it’s fairly easy to come up with a cleanup program. I named it IAMFlashClean and I’m hoping make it clean other viruses of the same kind as I encounter them.

You can download the IAMFlashClean Aikelyu virus cleaner here should anyone would want to use it.

IAM Flash Clean

Note: This software is offered FREE, "AS IS" and without any warranties. Use at your own risk.

IAMFlashClean 1.00

Virus Signatures:
- Aikelyu (Deadly-c.vbs)
- Aikelyu (pooh.vbs)

Requirements:

This software is written using the .Net Framework 2.0. Download and install before using this software.


Instructions:
1. Download the software by click the link above.
(Don't use a download manager. Files are small anyway.)
2. Unzip to any folder.
3. Double click IAMFlashClean.exe to begin cleaning.
4. A reboot may be required after cleaning.


If you want active protection against flash drive viruses, trojans and worms consider using IAM Flash Shield.