10 replies to this topic

[AutoProgramming]

AutoIt        expandcollapse  popup

;~ scan all drives for autorun.inf

#include <ButtonConstants.au3>
#include <EditConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

#Region ### START Koda GUI section ### Form=C:\Users\alexander\Documents\AutoIt\projects\AntiVir\Forms\autorun_editor.kxf
$Form1 = GUICreate("Autorun.inf Scanner // by AutoProgramming", 635, 444, 193, 125)
$Edit1 = GUICtrlCreateEdit("", 8, 40, 617, 393)
$CButton = GUICtrlCreateButton("Close", 8, 8, 75, 25, 0)
$IButton = GUICtrlCreateButton("Search for autorun.inf", 96, 8, 131, 25, 0)
$RCheckbox = GUICtrlCreateCheckbox("Search Removable Drives?", 240, 16, 169, 17)
GUISetState(@SW_SHOW)
#EndRegion ### END Koda GUI section ###

While 1
    $nMsg = GUIGetMsg()
    Switch $nMsg
        Case $GUI_EVENT_CLOSE
            Exit
            
        Case $IButton
            GUICtrlSetData($Edit1, "")
            
            If GUICtrlRead($RCheckbox) = 1 Then
                GetAll("removable")
            EndIf
            
            GetAll("fixed")
            GetAll("cdrom")
            
        Case $CButton
            Exit

    EndSwitch
WEnd


GetAll("fixed")
GetAll("cdrom")

Func GetAll($type)
    $var = DriveGetDrive($type)
    If NOT @error Then    
        For $i = 1 to $var[0]
            $path = $var[$i] & "\autorun.inf"
            
            If FileExists($path) Then
                GUICtrlAddData($Edit1, "--------------------------------------------------" & @CRLF)
                GUICtrlAddData($Edit1, "Autorun.inf @ " & $path & @CRLF)
                GUICtrlAddData($Edit1, "--------------------------------------------------" & @CRLF)
                $autorun = FileRead($path)
                GUICtrlAddData($Edit1, $autorun)
                GUICtrlAddData($Edit1, @CRLF & @CRLF)
            EndIf
        Next
    EndIf
EndFunc

Func GUICtrlAddData($GUIElement, $Data)
    GUICtrlSetData($GUIElement, GUICtrlRead($GUIElement) & $Data)
EndFunc

I think it's quite self-explainig -> This tool searches for autorun.inf in all drives and displays its content. Enjoy.

[Yashied]

It's a good idea. Suitable for finding viruses on flash drives.

[DaRam]

Excellent idea, it can be used to defeat the effort going on here http://www.autoitscript.com/forum/index.ph...c=92643&hl=

It's a good idea. Suitable for finding viruses on flash drives.

[A. Percy]

unless you have disabled the autorun function before, it may not be effective. Like that question: which came first, the chicken or the egg?

[AutoProgramming]

Excellent idea, it can be used to defeat the effort going on here http://www.autoitscript.com/forum/index.ph...c=92643&hl=

That's actualy where the idea comes from ;D

[GEOSoft]

unless you have disabled the autorun function before, it may not be effective. Like that question: which came first, the chicken or the egg?

If AutoRun is disabled, it won't matter if the AutoRun.inf file exists or not.

[A. Percy]

If AutoRun is disabled, it won't matter if the AutoRun.inf file exists or not.

But if isn't, it won't matter if you can see the contents of autorun.inf or not, your machine is infected if the file have bad content.

[killerofsix]

glad to see I inspired something
But for most PC's autorun is disabled and only appears as an option. For my USB finder it's just another way to lure the person who has your USB to run your app. This is a good defense against any malicious attempts to destroy your system through a usb or cd. good job with this script

[rajeshontheweb]

guys, i thought i had posted my edited version of the autorun finder ?? i will post the mod tomoro :-)

[rajeshontheweb]

Here it is ,

> shows which drives user has scanned already - as a confirmation that the program has run already :-)
> alerts user if the drive was not ready (typically if the memory card / zipdrive / removable media not inserted properly )
> Selects removable media also by default
<edited>
> search button on default focus

Attached Files

•  Scan4Autorun_old.au3   2.55K   142 downloads

Edited by rajeshontheweb, 08 April 2009 - 06:57 AM.

[rajeshontheweb]

Added Features:
> Edit Control is read only,
> If autorun.inf is a folder (typically ninja pendisk / flashdisinfector / myown driveprotection script, do that for security enabling on removable drives) lists folder contents.

Attached Files

•  Scan4Autorun.au3   2.84K   161 downloads