68 replies to this topic

[Brito]

ninja pendisk!

I've lost count on the number of times that I see pesky autorun.inf files that will surely infect the computer whenever someone double clicks on the pendisk icon and suddenly see their computer infected with all sort of viruses.

My favourite way to protect these pendisk would pass by manually removing these annoying files and create a folder called autorun.inf to avoid other infected computers to contaminate the pendisk again.

http://www.boot-land...?showtopic=4159


It simply takes too long to do all these steps manually on a single pendisk and I will never be able to control all pendisks that are in contact with these infected machines on my local area network.

To solve this matter, I've written a small tool to run silently on these client machines at the LAN where I work and keep these pendisks a bit safer.

-------------

Full description and download: http://nunobrito.eu/ninja

-------------

Main features:

• Self-update executable and database
• No install required
• Freeware
• LAN chat
• Multi-Language

This tool has helped me a lot, hope you like it.





----------------

Log of changes


version 1.2:

Better language detection
Option to add a shortcut on the starup folder
Option to rename files on ninja.txt (good for autorun.inf)

[pscEx]

ninja pendisk!

To solve this matter, I've written a small tool to run silently on these client machines at the LAN where I work and keep these pendisks a bit safer.


Main features:

• Self-update executable and database
• No install required
• Freeware
• LAN chat
• Multi-Language

This tool has helped me a lot, hope you like it.

There seem to be some starter troubles:
I did a download and placed ninja.exe on my desktop (spaces in path)
When I double clicked, I got the message that ninja.text is not found.

So I created an empty ninja.txt file on my desktop and started ninja again. This time it went into the sys tray.

I insersed a stick and got an error 'Index out of bounds'.

BTW: the idea is great. I hope that a fixed version will work for me soon.

Peter

[Brito]

ninja should download a fresh txt file on startup.

The contents of ninja.txt should be these:

--->   ninja pendisk!   <---This ninja program is freeware and is happy to be included or distributed by everyone interested in sharing this program.---> What does it do?It will automagically remove any pesky virulent file found on usb pendisks that may threat your computer.Click on the tray icon and visit our webpageto tell us about new threats that should alsobe removed by this ninja.Nuno Brito © 2008[url="http://nunobrito.eu"]http://nunobrito.eu[/url]--------------------------------[version]updated=2008-04-04program=1.0[options]no_minimize=0[languages]en=How to get started?;Immunize;Plug your pendisk to the computer;If you&#39;re ready to protect your pendisk, click on the immunize button!;Exit;View configuration;Visit homepage;LAN Chatpt=Como começar?;Imunizar;Ligue a pendisk ao computador;Se estiver pronto para começar, clique no botão Imunizar!;Sair;Ver configuração;Visitar homepage;Chat localde=How to get started?;Immunisieren;Schließen Sie Ihren pendisk auf den Computer;Wenn Sie bereit sind, zum Schutz Ihrer pendisk, klicken Sie auf die Schaltfläche immunisieren!;Exit;Konfiguration anzeigen;Besuchen Sie Homepage;LAN Chatfr=Comment démarrer?;Vaccination;Branchez votre pendisk à l&#39;ordinateur;Si vous êtes prêt à protéger vos pendisk, cliquez sur le bouton vacciner!;Sortie;Voir la configuration;Visitez la page d&#39;accueil;LAN Chates=¿Por dónde empiezo?;Inmunizar;Conecte su pendisk a lo ordenador;Si está listo para proteger su pendisk, haga clic en el botón inmunizar!;Ver configuración;Visita la página principal;LAN Chat	--------------------------------[attrib_initial]autorun.inf=-s -h -r[file_delete]auto.exeautorun.infautorun.iniautorun.pifautorun.vbsautorun.exeautorun.batautorun.cmdautorun.htaavpo.exeBha.dll.vbsctfmon.execopy.exedestrukto.vbsFucker.vbsHeap41akillvbs.vbshost.exeimvo.exeMacromedia_Setup.exemmc.exemsvcr71.dlntde1ect.comnideiect.comntdelect.comNew Folder.exeoso.exeRavmon.exeRavMonE.exeRVHost.exespoclsv.exesoundmix.exesvchost.exesemo2X.exetel.exe.vbsutdetect.comVBS_RESULOWS.Awindows.scr[folder_delete]Recycled[folder_create]autorun.inf[attrib_finish]autorun.inf=+s +h +r

http://nunobrito.eu/ninja/ninja.txt

--------------------------

Will correct the binary.

[pscEx]

ninja should download a fresh txt file on startup.

The contents of ninja.txt should be these:

With the text you defined it now works

But I did not see any attempt to load a new ninja.txt.

May it depend on that I have a router with built in SW firewall?

Peter

[Brito]

Yes, you need to let this program use the internet.

I've modified the executable and it now contains a copy of ninja.txt which will be extracted to the disk in case there is no available web connection.

The new binary was uploaded.

----

Did you liked this tool?

[pscEx]

Yes, you need to let this program use the internet.

I've modified the executable and it now contains a copy of ninja.txt which will be extracted to the disk in case there is no available web connection.

The new binary was uploaded.

----

Did you liked this tool?

The new version loads well and downloads the missing ninja.txt, in C: as well as in a path with spaces.

Yes, I like this tool. But you know me, i at once have a concern / suggestion:

My OS builtin 'detected new drive' popped up simultaniously with ninja's question whether to immunize.

I know that the OS 'detect new drive' can be switched off anywhere in the registry:

If this popup is activated, ninja should

• switch off on start
• pop that message up after immunizing, maybe clone the deleted autostart.inf
• switch on on exit (includes when beeing killed on boot)

So for the user which e.g wants to hear his MP3 just by inserting the stick, the only change would be that ninja asks for something.

Peter

[Brito]

Good suggestions.

I also gave some thoughts about that matter but then I reminded of the following:

- I wasn't sure where in the registry this "autorun wizard" could be disabled, even thought I already have a clue:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]

@="@SYS:DoesNotExist"

- And would Vista UAC allow changing the registry?

As solution I made the window stand in front of all other windows so that it could obfuscate the "autorun wizard".

btw: I am intercepting the windows message that warns when a new removable USB device is plugged, now that I think about your request perhaps I could suppress this message and this way don't even trigger the "autorun wizard" at all - except after running the ninja.

-------------------

Can also add a section on ninja.txt to support renaming files and this way allow renaming autorun.inf to autorun.old.txt but are there many reasons to have a autorun.inf files on USB pendisks over these days?

[Elcidio Orlando]

Ola Nuno

I've downloaded the latest version of your program and ran it straight from the desktop but it still says list index out of bounds, the ninja.txt file automatically appeared on the desktop too, with all the required content... I don't understand why it displays that error message if everything seems to be correct...

must I not run it from the desktop?

[Brito]

Olá Elcidio!

You're doing all the right steps, so I'm assuming that it is something not handled by ninja.exe (yet)

I've included support for five languages (english, portuguese, german, french and spanish), I thought Mozambique would be included in the portuguese language group but perhaps the detection code that I'm using is not returning the language but rather the OS country.

I've uploaded a new binary that will default to english whenever a country code is not found on ninja.txt list.

You can also override the language definition on ninja.txt:

ar-SA      0x0401  Arabic (Saudi Arabia)   ar-IQ      0x0801  Arabic (Iraq)   ar-EG      0x0C01  Arabic (Egypt)   ar-LY      0x1001  Arabic (Libya)   ar-DZ      0x1401  Arabic (Algeria)   ar-MA      0x1801  Arabic (Morocco)   ar-TN      0x1C01  Arabic (Tunisia)   ar-OM      0x2001  Arabic (Oman)   ar-YE      0x2401  Arabic (Yemen)   ar-SY      0x2801  Arabic (Syria)   ar-JO      0x2C01  Arabic (Jordan)   ar-LB      0x3001  Arabic (Lebanon)   ar-KW      0x3401  Arabic (Kuwait)   ar-AE      0x3801  Arabic (U.A.E.)   ar-BH      0x3C01  Arabic (Bahrain)   ar-QA      0x4001  Arabic (Qatar)   bg-BG      0x0402  Bulgarian (Bulgaria)   ca-ES      0x0403  Catalan (Catalan)   zh-TW      0x0404  Chinese (Taiwan)   zh-CN      0x0804  Chinese (People's Republic of China)   zh-HK      0x0C04  Chinese (Hong Kong S.A.R.)   zh-SG      0x1004  Chinese (Singapore)   zh-MO      0x1404  Chinese (Macau S.A.R.)   cs-CZ      0x0405  Czech (Czech Republic)   da-DK      0x0406  Danish (Denmark)   de-DE      0x0407  German (Germany)   de-CH      0x0807  German (Switzerland)   de-AT      0x0C07  German (Austria)   de-LU      0x1007  German (Luxembourg)   de-LI      0x1407  German (Liechtenstein)   el-GR      0x0408  Greek (Greece)   en-US      0x0409  English (United States)   en-GB      0x0809  English (United Kingdom)   en-AU      0x0C09  English (Australia)   en-CA      0x1009  English (Canada)   en-NZ      0x1409  English (New Zealand)   en-IE      0x1809  English (Ireland)   en-ZA      0x1C09  English (South Africa)   en-JM      0x2009  English (Jamaica)   en-CB      0x2409  English (Caribbean)   en-BZ      0x2809  English (Belize)   en-TT      0x2C09  English (Trinidad and Tobago)   en-ZW      0x3009  English (Zimbabwe)   en-PH      0x3409  English (Republic of the Philippines)   es-MX      0x080A  Spanish (Mexico)   es-ES      0x0C0A  Spanish (Spain)   es-GT      0x100A  Spanish (Guatemala)   es-CR      0x140A  Spanish (Costa Rica)   es-PA      0x180A  Spanish (Panama)   es-DO      0x1C0A  Spanish (Dominican Republic)   es-VE      0x200A  Spanish (Venezuela)   es-CO      0x240A  Spanish (Colombia)   es-PE      0x280A  Spanish (Peru)   es-AR      0x2C0A  Spanish (Argentina)   es-EC      0x300A  Spanish (Ecuador)   es-CL      0x340A  Spanish (Chile)   es-UY      0x380A  Spanish (Uruguay)   es-PY      0x3C0A  Spanish (Paraguay)   es-BO      0x400A  Spanish (Bolivia)   es-SV      0x440A  Spanish (El Salvador)   es-HN      0x480A  Spanish (Honduras)   es-NI      0x4C0A  Spanish (Nicaragua)   es-PR      0x500A  Spanish (Puerto Rico)   fi-FI      0x040B  Finnish (Finland)   fr-FR      0x040C  French (France)   fr-BE      0x080C  French (Belgium)   fr-CA      0x0C0C  French (Canada)   fr-CH      0x100C  French (Switzerland)   fr-LU      0x140C  French (Luxembourg)   fr-MC      0x180C  French (Principality of Monaco)   he-IL      0x040D  Hebrew (Israel)   hu-HU      0x040E  Hungarian (Hungary)   is-IS      0x040F  Icelandic (Iceland)   it-IT      0x0410  Italian (Italy)   it-CH      0x0810  Italian (Switzerland)   ja-JP      0x0411  Japanese (Japan)   ko-KR      0x0412  Korean (Korea)   nl-NL      0x0413  Dutch (Netherlands)   nl-BE      0x0813  Dutch (Belgium)   nb-NO      0x0414  Norwegian (Bokm?l) (Norway)   nn-NO      0x0814  Norwegian (Nynorsk) (Norway)   pl-PL      0x0415  Polish (Poland)   pt-BR      0x0416  Portuguese (Brazil)   pt-PT      0x0816  Portuguese (Portugal)   ro-RO      0x0418  Romanian (Romania)   ru-RU      0x0419  Russian (Russia)   hr-HR      0x041A  Croatian (Croatia)   sr-SP-Latn 0x081A  Serbian (Latin) (Serbia)   sr-SP-Cyrl 0x0C1A  Serbian (Cyrillic) (Serbia)   sk-SK      0x041B  Slovak (Slovakia)   sq-AL      0x041C  Albanian (Albania)   sv-SE      0x041D  Swedish (Sweden)   sv-FI      0x081D  Swedish (Finland)   th-TH      0x041E  Thai (Thailand)   tr-TR      0x041F  Turkish (Turkey)   ur-PK      0x0420  Urdu (Islamic Republic of Pakistan)   id-ID      0x0421  Indonesian (Indonesia)   uk-UA      0x0422  Ukrainian (Ukraine)   be-BY      0x0423  Belarusian (Belarus)   sl-SI      0x0424  Slovenian (Slovenia)   et-EE      0x0425  Estonian (Estonia)   lv-LV      0x0426  Latvian (Latvia)   lt-LT      0x0427  Lithuanian (Lithuania)   fa-IR      0x0429  Farsi (Iran)   vi-VN      0x042A  Vietnamese (Viet Nam)   hy-AM      0x042B  Armenian (Armenia)   az-AZ-Latn 0x042C  Azeri (Latin) (Azerbaijan)   az-AZ-Cyrl 0x082C  Azeri (Cyrillic) (Azerbaijan)   eu-ES      0x042D  Basque (Basque)   mk-MK      0x042F  FYRO Macedonian (Former Yugoslav Republic of Macedonia)   af-ZA      0x0436  Afrikaans (South Africa)   ka-GE      0x0437  Georgian (Georgia)   fo-FO      0x0438  Faroese (Faroe Islands)   hi-IN      0x0439  Hindi (India)   ms-MY      0x043E  Malay (Malaysia)   ms-BN      0x083E  Malay (Brunei Darussalam)   kk-KZ      0x043F  Kazakh (Kazakhstan)   ky-KZ      0x0440  Kyrgyz (Kyrgyzstan)   sw-KE      0x0441  Swahili (Kenya)   uz-UZ-Latn 0x0443  Uzbek (Latin) (Uzbekistan)   uz-UZ-Cyrl 0x0843  Uzbek (Cyrillic) (Uzbekistan)   tt-RU      0x0444  Tatar (Russia)   pa-IN      0x0446  Punjabi (India)   gu-IN      0x0447  Gujarati (India)   ta-IN      0x0449  Tamil (India)   te-IN      0x044A  Telugu (India)   kn-IN      0x044B  Kannada (India)   mr-IN      0x044E  Marathi (India)   sa-IN      0x044F  Sanskrit (India)   mn-MN      0x0450  Mongolian (Mongolia)   gl-ES      0x0456  Galician (Galician)   kok-IN     0x0457  Konkani (India)   syr-SY     0x045A  Syriac (Syria)   div-MV     0x0465  Divehi (Maldives)

Boa sorte!

[Ganesh Rao]

A very good tool.....
( I am using Windows XP)
But I wish if it:-
1.) Could use lesser memory(processes in task manager shows memory usage 6084k......I mean when no pendrive is inserted...it would be better if it uses lesser memory.

2.)It seems it doesn't automatically start with windows...i.e. no startup entry.

3.)I would like it to have an option to automatically clean the Pendrive without user interaction as default..(I want to use it in my college where students don't know the importance of having a clean pendrive and then complain that the computers are all infected)

4.)It should be like antivirus engine....not allowing autorun to execute till ninja popup is either closed or it has cleaned the Pendrive.

Anyways great job.....looking forward for future releases.

[Brito]

Hi freaksterrao,

1. On my vista machine the ram consumption is around 2Mb and I tried on a emulated XP which used around 3Mb, once I started using some the functions it would increase to 4Mb or quickly lower to 804Kb - sorry because I don't really know how to control or reduce this, but at least it won't be consuming CPU resources while waiting for pendisks to be plugged.

Here's my screenshot with ram usage:



2. Adding a shortcut to the startup folder could do the trick but I see that our goal here is giving this tool as a present to those who don't even know to do shortcuts in the first place or ease this step while installing in new computers..

3. Sure it can be done. I have one question: should there be any warning about this automated cleanup action?

4. Also suggested the same thing - to intercept the windows notification that a new pendisk arrived and do our cleanup first.

Thank you for this feedback, it's a good help when more people look into the program and propose what be done next.

[MedEvil]

Hi freaksterrao,

1. On my vista machine the ram consumption is around 2Mb and I tried on a emulated XP which used around 3Mb, once I started using some the functions it would increase to 4Mb or quickly lower to 804Kb - sorry because I don't really know how to control or reduce this....

Nuno you forgot to take the used/needed virtual memory into account and there's nothing you can do about it. Delphi programs are big.

[Ganesh Rao]

Hi freaksterrao,

1. On my vista machine the ram consumption is around 2Mb and I tried on a emulated XP which used around 3Mb, once I started using some the functions it would increase to 4Mb or quickly lower to 804Kb - sorry because I don't really know how to control or reduce this, but at least it won't be consuming CPU resources while waiting for pendisks to be plugged.

Here's my screenshot with ram usage:



2. Adding a shortcut to the startup folder could do the trick but I see that our goal here is giving this tool as a present to those who don't even know to do shortcuts in the first place or ease this step while installing in new computers..

3. Sure it can be done. I have one question: should there be any warning about this automated cleanup action?

4. Also suggested the same thing - to intercept the windows notification that a new pendisk arrived and do our cleanup first.

Thank you for this feedback, it's a good help when more people look into the program and propose what be done next.

My pleasure......
As far as I feel for someone who will use it personally.....automated cleaning action is not required...
But as you suggested and by the looks of it..its a great tool for LAN.....and hence there should be an option for automated cleaning which would be confirmed by the program on first start(i.e. installation by system admin).(Basically like an Antivirus engine with defaults)
And as it was suggested......instead of deleting....rename the autorun(by default) for those who wanted the autorun for easy retrieval.

[pscEx]

And as it was suggested......instead of deleting....rename the autorun(by default) for those who wanted the autorun for easy retrieval.

I agree. That was one of the ideas I have had on the first view, but I forgot to post.

Peter

[Ganesh Rao]

I Have two removable drives....1st is a 1GB PenDrive(PD)....2nd a 30GB Ipod Video.
a )When I insert my PD, ninja detects it, shows me the 'immunize' dialog and the dialog is persistent.
However, autorun executes in the background.

b )[And this is the Problem]When I insert my Ipod,(At the first instance)it detects it and 'immunize' dialog opens & remains open for ~4 secs and closes......Autorun executes.(Displays an icon)

And when I 'Safely remove disk' and plug the ipod in again(without logout or rebooting).......comp doesnt recognize it immediately, but does it after a delay, ninja doesn't display the 'immunize' dialog and crashes(i.e. closes down).

Any solutions???

[pscEx]

I Have two removable drives....1st is a 1GB PenDrive(PD)....2nd a 30GB Ipod Video.
a )When I insert my PD, ninja detects it, shows me the 'immunize' dialog and the dialog is persistent.
However, autorun executes in the background.

Remembers me a bit on my post #6

Peter

[Brito]

I'm not having much success in suppressing completely the "autorun wizard" that shows up when the pendisk is plugged on the machine.

Anyone has ideas how this can be solved?

[Brito]

Version 1.2 uploaded.

You can either delete ninja.txt and restart ninja.exe to test the auto-update feature or download the new version from http://nunobrito.eu/ninja


log of changes:

Better language detection
Option to add a shortcut on the startup folder
Option to rename files on ninja.txt (good for autorun.inf)

[Ganesh Rao]

Version 1.2 uploaded.

You can either delete ninja.txt and restart ninja.exe to test the auto-update feature or download the new version from http://nunobrito.eu/ninja


log of changes:

Thnaks for including our suggestions......

[pscEx]

Nuno, please use this as 'official' German text:

de=Wie geht es?;Immunisieren;Stecken Sie Ihren USB-Stick in den Computer;Zum Schutz Ihres USB-Sticks klicken Sie auf die Schaltfläche 'Immunisieren'!;Ende;Konfiguration anzeigen;Ninja Homepage;LAN Chat;Ninja in Autostart aufnehmen

Peter

[Brito]

Thank you!

[Ganesh Rao]

*Found this page in google to disable Autorun for all users....
a)by application windows (<<<====)
b)registry entry

http://forum.tweakxp...essageid=146482

*The startup included in Ninja is valid only for current user.It would be better if it was for all users(using HKLM key).

*Also every time the error message" List out of bounds(2)" pops up.....everything becomes ok after this error dialog is closed.

*I suggest that an installer makes a folder in program files where ninja & the configuration are copied and a registry HKLM key is created for all users. Plus the installer can have options page where all defaults can be verified which the user(admin).

*Still no solution for ninja crashing due to Ipod.

[Brito]

You're a genius Ganesh!

That link was very helpful - will get back to coding now.

-----------------

1.3 version uploaded

Now if the option is selected, will automatically clean up the plugged pendisk without need to press the button.

Also hope that the language bug is now solved.

[pscEx]

1.3 version uploaded

Also hope that the language bug is now solved.

But my Geramn changes are lost

Peter

[Brito]

Version 1.4 released!

• added - option to silently clean all inserted pendisks only displaying results box
• added - option to completely disable autoplay
• added - when using switch "/install" from command line will silently install ninja on the computer
• modified - failsafe values to load language
• modified - german language was updated by native german speaker (thanks Peter)
• modified - Add to startup option will create a shortcut on the startup folder and also copy ninja.exe and ninja.txt to a folder on Program Files

As mentioned before, the autorun box that appears when you plug a pendisk is disabled and it was not necessary to write any registry keys meaning that when you quit the program or deactivate this feature - your autorun will still work as before.


Haven't yet modified the shortcut creation to make the shortcut available for all users but it is not forgotten.


Known bugs:

Still crashing on special cases when the plugged USB pendisk is not a simple pendisk (example: mp3 players, ipod, etc)


Hope you like this new version.