I have a USB flash drive that is packed with free and portable tools that can help me detect and clean virus from a computer. It is small for me to carry it along and convenient, just plug in and I can run my tools. However, there’s a big problem when I use the tools from my USB flash drive. Since a USB flash drive can be written, virus usually copies itself to the USB flash drive and creates an autorun.inf that has instructions to run the virus whenever it is open from Explorer. Not only that, there are some very destructive virus such as JambanMu / Almanahe that embeds itself to all executable files and corrupting them.
Then, there are times when the user installed crappy antivirus software that automatically deletes my virus removal tools thinking it is a threat. Some examples are Brontok-Washer being flagged as Brontok virus, CaSIR as FakeAV and etc. Sometimes I really wonder why the antivirus program can be so “smart” in detecting my virus removal tools as threat and automatically deleting them but the REAL virus is still inside the computer?
I could burn the virus removal tools in a CD-RW but it is slow and troublesome. So I need a USB flash drive that has a physical write protect switch like in floppy disks which only allows read-only.
I tried searching in a few computer shops but failed to find any USB flash drive with write protect switch. I remembered that I have a SanDisk Cruzer Titanium 4GB U3 USB flash drive and perhaps I could remove the U3 LaunchPad and install my tools into the virtual CD drive.
Normal USB flash drives only creates 1 drive letter but for U3 smart drive, it has 2 drives. One is the normal storage drive where you can copy and delete any files in it and the other one is an emulated CD drive which is read-only. As you can see at the image below, C drive is my computer hard drive, D is internal DVD-RW drive, E and F drive comes from the U3 smart drive.
In a normal U3 smart drive, when you plug it in a computer with autorun enabled, it will automatically run U3 LaunchPad. The LaunchPad is launched from the emulated virtual CD drive. So I was thinking if I could somehow remove or uninstall the U3 LaunchPad and replace it with my virus removal tools, that’d solve the problem. I did a little research and found that it is possible to hack the U3 LaunchPad.
1. Download Universal Customizer provided by Hak5, a reputable group of hardcore geeks.
2. Extract the downloaded Universal_Customizer.zip file.
3. Copy all your virus removal tools or anything you want to U3CUSTOM folder in Universal_Customizer.
4. Run ISOCreate.cmd from Universal_Customizer folder and it will create an ISO image from the files in the U3CUSTOM folder. When done, press any key to continue to close the command prompt window.
5. Now run Universal_Customizer.exe and insert your U3 USB flash drive.
6. U3 Customizer should detect your U3 smart drive. Select Accept to accept the agreement and click the Next button.
7. Make sure that all U3 Smart applications, and any applications that access your U3 smart drive are closed. Also, do not eject or shut down the computer before the process is complete. Click Next button again.
8. Enter a password twice and click Next. The U3 Customizer will backup all your data on your U3 smart drive, format your U3 smart drive, customzie your version of the U3 CD-ROM and finally restore your data.
9. Click Done button. You have to remove and re-insert your U3 smart drive for the settings to take effect.
Voila! The U3 CD-ROM drive now contains all the files that you copied to the U3CUSTOM folder and the annoying useless U3 LaunchPad has been uninstalled. Now I don’t need to rush to every computer shop to look for a USB flash drive with write protect switch because I already have a pendrive with read-only protection.
Updating after my post from last year, I’ve put together a listing of available drives on fencepost.net/nS. At this point the available ones appear to be only Imation (Pivot, Clip, older Swivels), Kanguru, PQI’s U339 line and RITEK/RiDATA Slider and Twister.
-maxell venture usb 4 gb-sora-mea as sters de pe el softul si acum merge numa o partitie de pe el pe vista iar pe windows 7 merg amandoua!!!
-cu sa-l fac o singura partitie de 4 pe el?-care sa mearga si pe vista
USB sticks with micro switch write protects do exist.
Transcend and others do make them.
Dumb clicking on legal agreements as the U3 article suggests is a legal trojan horse – before you know it someone else in some corrupt private law country will claim to have legal first storage/play/broadcast rights to your own software collection or work and eventually try to deny you the right to even read your own work.
Happy Hanuka to all.
Please note Chanuka 2010 is not Hanuka dates.
best wishes Terence
boss tolong dong flash disk U3 saya lock ya hilang dan sekarang tidak bisa di passwot gimn cara mengkebalikan ya ya…………
The Imation Swivel, Pivot and Clip lines of flash drives (but NOT the Swivel Pro/Pivot Plus) include a write protect switch. Available up to 32GB, you can get precise part/model numbers from Imation’s website. Check the detailed features list for the models you’re looking at to confirm the switch.
The Trekstor 50324 8GB USB-Stick CS Flash Drive has an external Write protect switch.
JR.com is currently out but should be getting more in.
hey.. i want the product key of Norton Antivirus 2009
Very cool for those of you who carry around confidential data, but being a tech guy, I’m always moving stuff on and off. I guess that could be a reason to have this as well.
Are you going to tell us what virus remove tools you have on your usb drive? If you are then next question is when?
Hi, Ray you are the greatest, i would like to know how to desable some processes which are runnig in the background and which may cause my computur to run slowly and which negative consequences it might bring to desable a process.
which processes should never be disabled?
Dear Ray,
This is just for your information. I am using an Imation Swivel Flash drive and it has a physical read/write lock.
Thanks for this tip.
Another possibility would be to use drivesentry goanywhere on your removable drives and devices.
George Paul (or Raymond)
can you please explain what you mean with ufd utility?
raymond the drawback with this way over a switch is: that if you want to add a tool you have to start over from step 1 and redo the whole iso and everything!!!
U3 technology is nice to protect U3 usb devices I agree with xcalibrator usb manufactures should condider these mine have normal usb flash drive what to do with these when we buy new ones with U3 technology.
I too carry USB drive, but I am not afraid of virus jumping on it, I am afraid that Anti Virus program deletes some of the programs I have on it, like key finder, protected area dump, etc :).
Many time I forget to disable the resident shield.
I Ray ;)
Other valid solution is a USB SD\SDHC card reader adapter. These memory cards (SD\SDHC\MMC) have a switch for enable read\write operations and can replace a conventional flash drive.
Thanks for the tip, Raymond.
I was looking for a USB flash drive with write protect switch for a long time, but I just gave up.
Now I\’m using a USB card reader with CF or SD cards.
You can use ufd utility to create a security area to keep your important files.Using hitachi driver you can convert your removable to local disk
I too carry around virus removal tools like that. Thanks Raymond. I don’t have a U3 drive.
One question – which is the pendrive in the pic above that has a switch ? I’d prefer one with switch rather than using a u3 drive.
By using Universal Customizer, users whose U3 pendrive’s sizes exceed 4 gb (like 8 gb in my case), for instance, will automatically become recognized by Windows as 3.84 Gb, there’s a solution on the Hak5 forums that maybe Raymond should post up.
thanks for the info… :)
Hey, nice trick man!
Seriously though USB drive manufacturer’s should consider having such switches! I actually own one, comes in quite handy whn i know the comp in front of me is infected by an enormous number of viruses.
This is only for U3 enabled flash drives. My virus removal collection is huge. Will post about it someday.
is this only works for U3 how about in other usb drive?
one more question ray may we know what is your virus removal collection? :)
thanks ray!