suggestions on protecting PC from usb thumb drives?

[nairb]

I'm starting to incorporate more printing for customers on top of my own print sales in my gallery and am obviously concerned about the number of thumb drives that will now be interacting with my windows 7 pc as people bring their files in. Does anyone have good suggestions on the best way to protect myself from these things?

[aduke]

Who will be operating the PC, you or the customer? Will it be connected to  your network? What other work will be done on that PC?

Alan

[nairb]

It's just me using it for processing photos, printing from photoshop, using my accounting software and using the internet. I only do those things from a limited user account which means I only use an admin account for adding, updating or removing programs. Both those accounts have strong passwords and I have "fast user switching" turned off. Because of those practices, I am comfortable not using any anti-virus software.

It's connected to the wifi internet and both my printers via usb.

My main concern is what my only computer is exposed to by having other peoples thumb drives plugged into it and the autorun.ini or exe files that most usb sticks initialize with and seem to be used to transfer malicious stuff.

I'm assuming that others with the same concerns would likely be relying on some kind of anti virus software as I can't really come up with any other ideas to protect myself. The only thing I really thought of was to use a separate linux laptop to act as a buffer between the computers, but in all likely hood, any malicious files/programs would just pass through linux without affecting it only to eventually be passed on to my windows desktop anyway.

[jduncan]

It's just me using it for processing photos, printing from photoshop, using my accounting software and using the internet. I only do those things from a limited user account which means I only use an admin account for adding, updating or removing programs. Both those accounts have strong passwords and I have "fast user switching" turned off. Because of those practices, I am comfortable not using any anti-virus software.

It's connected to the wifi internet and both my printers via usb.

My main concern is what my only computer is exposed to by having other peoples thumb drives plugged into it and the autorun.ini or exe files that most usb sticks initialize with and seem to be used to transfer malicious stuff.

I'm assuming that others with the same concerns would likely be relying on some kind of anti virus software as I can't really come up with any other ideas to protect myself. The only thing I really thought of was to use a separate linux laptop to act as a buffer between the computers, but in all likely hood, any malicious files/programs would just pass through linux without affecting it only to eventually be passed on to my windows desktop anyway.

Yo are right abut Linux. I know you know this, but I will recommend that you run an antivirus program.  If you are concern about the performance impact, then run a free antivirus on your Linux buffer.  Changing the format of the files saying to 16bit Tiff is likely to protect from some virus, but I will NOT suggest  this, as it impact the file.

Best regards,

J. Duncan

[EduPerez]

[...]
My main concern is what my only computer is exposed to by having other peoples thumb drives plugged into it and the autorun.ini or exe files that most usb sticks initialize with and seem to be used to transfer malicious stuff.
[...]

You can also disable autoplay/autorun, and Windows will then do nothing when you insert a drive.

[Kanvas Keepsakes]

This is what I use.  Works great.  Lets your immunize your PC (disable auto run) and also instantly immunizes the autorun file on every USB you plug into your PC.  Just freezes it so it won't get infected in the future. 

http://research.pandasecurity.com/Panda-USB-and-AutoRun-Vaccine/

[nairb]

Thanks for that. It appeared to be just what I was looking for, although digging deeper into that blog, it seems that software was designed in 2009 or earlier primarily for XP and Vista vulnerabilities. It seems that Microsoft addressed the problems with Autoplay and Autorun.inf in Windows 7 according to this post from the same blog:

http://research.pandasecurity.com/microsofts-6-year-long-open-door-to-malware/

Unfortunately the blog hasn't been updated since 2011.

If I don't need to be concerned with .inf in Windows 7, are there perhaps new threats that have been deployed since it's introduction? Or perhaps I don't need to be worried at all about sticking unknown USB drives into my desktop?

[PeterAit]

Get a cheap netbook, a few hundred $, and plug the USB drive into that. Then transfer the legitimate files to your main computer.

[aduke]

Get a cheap netbook, a few hundred $, and plug the USB drive into that. Then transfer the legitimate files to your main computer.

And have an image from which you can restore to a clean machine.

Alan

[nairb]

Getting a cheap notebook was my first thought, but like mentioned earlier regarding the linux option, it might just be a vessel through which the virus would pass; unless I'm just using the cheap computer to scan the usb for malware... if it's clean, plug it into my desktop (or transfer to my own usb then to my desktop)...

[BJL]

You can also disable autoplay/autorun, and Windows will then do nothing when you insert a drive.

Indeed. My only question is whether autorun with external media is still on by default in Windows 7 and 8, and  why almost anyone these days would want it on, for the sake of avoiding one click in a dialogue box. Surely that level of trust for the sake of a small convenience has gone like the days of leaving your car unlocked and the house key under the doormat.