I made a study on trojans some years back and noticed they all have one thing in common, they will usually attach to
the autorun.inf file on the root of your hard drive and set themselves to invisible.

If you can use ms-dos. Let us assume your flash is on drive f as in F:\
And you want to find out if there is a trojan on it, just open your dos console.
C:\>F:
F:\>attrib -s -h -r autorun.*
F:\>dir autorun.*

That will make visible any file that has autorun as the file name. The autorun file can carry macros/commands that are executed
immediately you double-click on a drive. It is the same autorun that we use in making a cd start a program immediately it is inserted
into a drive. Except that for a flash drive, it cannot automatically start like that until the flash is double-clicked. The flash drives that
come with all these softwares that start when windows is booted use a second partition which behaves like a cd and autplay on insertion.

Quickly, lemme say that all antitrojans use autorun.inf files, but different other file names and contents. It seems the antiviruses usually target
something specific in a trojan after it has been reported before it can detect it.
Meaning that, if i create a trojan right now (will take me less than 5 minutes - and i only need windows notepad to do that) all those them antiviruses
will not know what it is, and will allow it to run freely like that, until someone detect it. The only way it can detect one i make immediately is if i copy
someone else to do so.

Anyway, i made this very small application that is able to displace any trojans from your flash and make it safe to open.
I did not say it will kill the virus, all it does is, to replace the autorun.inf one with a fresh copy that is not infected.
THen it will make your flash drive or hard disk display it's own icon which will tell you that it is safe to double-click
your flash.

The trojan will be hidden on your drive, harmless unless you make it visible and double-click it. when u get a good antivirus then you can now remove it.


You can download it from my site: http://mwebng.net/download/search.php?url=troy.zip  -  i created it with c++ some years back and have not updated it since then.

It is a command-line application with no GUI - i do not want to start competing with major antiviruses.
Besides i made it for myself - just though to share it with people around me.

So the download is 310 Kb containing troy.exe - a standalone 1.27 Mb executable file. Compatible with
all versions of windows from 98 and above.

To make use of it. Let us assume you just inserted a flash drive or in fact any removeable device into your pc
and you are afraid of trojans.

After the drive has finished detecting and all that. THen open "My Computer", you should see the drive letter
again lemme assume F:\

Then you will now send the troy.exe into the drive. So that the path to the application will be F:\Troy.exe

Then you will now open the Run dialog on start menu. You can open it fast by using Logo_key + R


Then you enter the command f:\troy.exe into it, after that, it will popout, execute the program and finish.

After that, your flash drive will now carry the icon of the troy application. Telling you it is safe to double click.

Mind you, my own flash drive happen to be on drive H rather than f, so the command will be modified to h:\troy.exe or h:\troy

Notice how my flash drive's icon changed from nothing to the icon of the troy application.

Now some trojans will display some funny menus when you right-click on them - this my app
will get rid of that one too.

Then most importantly, some antiviruses after they have removed the trojan, you may find
it difficult to double-click to open the flash, it will open an Open With dialog box with
windows asking you to choose a program to open your flash drive.
Just use my application to clean that up too.

Any questions will be answered at this point.

@dhtml
From what I have read it looks like a good antivirus tool for flashdrives, but how am I sure that this Troy.exe program is not a trojan itself or a spyware?

well, do not be deceived by the name. . .proof, if you have microsoft visual c++ 6.0, i can post the source code here so that you will recompile it yourself, that is the only way you can be sure. . .and i moderate this board too. . .so i am supposed to be accountable iight?

I almost posted the source code, but i was thinking because this is not programming section, i dont like posting off-topics. . .

Alternatively, you can scan the troy.exe itself with any antivirus you like to see if it will kill it or complain about it. . .

I cant even find the code again, it must be in my backups somewhere, but the lines of codes are not much anyway. . .
I can even rewrite it as an ms-dos batch file in less than 10 lines too. . .