Ghost is a honeypot for malware that spreads via USB storage devices. It detects infections with such malware without the need of any further information.

The honeypot emulates a USB storage device. If your machine is infected by malware that uses such devices for propagation, the honeypot will trick it into infecting the emulated device.

At the moment, Ghost only supports Windows XP 32 bit. It is in an early stage of development, which is why you should be appropiately careful when using the software.

You can either download a binary distribution of Ghost or compile the code yourself. If you choose to build the code, you will need the Windows Driver Kit.