Pendrive affected by 'folder virus' and keeps remounting every two minutes or so.

[svzard]

Hi all,
I've a problem with my pendrive. I'm looking for some help. It
sure is a windows virus but it has corrupted my pendrive and
hence I'm seeking help here in linux forums. If this is not the
proper forum kindly move it to the proper one. But somehow
help me with the problem.

I don't know the exact name of this virus/trojan. I usually call
it 'the folder virus'. It creates an exe file by the same name as
the folder. The more folders you have the more exe files by their
name you have. Apart from these 'foldername.exe' files we can
sometimes see a file by name 'MicrosoftPowerPoint.exe' and/or
'autorun.inf'. All these days I either used the anti-virus s/w or
would login to linux and manually delete the exe files.

This time however the pendrive had an additional file by name
'VirusRemoval.vbs' apart from the exe files I named earlier. The
problem I faced this time is that the pen drive would auto-mount
several times. That way I had a terrible time in using linux to
remove the exe files and copying the data files. I persisted and
somehow managed to remove all the exe files. I then formatted the
pendrive. I thought that would have solved my problem and tried
to copy back the data to the pendrive. But to my horror the drive
again started to remount itself every two minutes or so, not
allowing me to copy back the files.

Let me add that the pendrive is a Transcend V30 series 4GB drive.
I searched for firmware but didnot find anything in their site.
Found a software called mFormat and used it to format the drive
again. But still no help. Whether I connect it to windows or
linux it doesnot matter, it just keeps remounting itself. It
either mounts as sdb1 or as sdc1. Whats wrong? How to get rid
of this? If I scan the pendrive it doesnot show any sign of virus.

The drive is almost dead now. Don't know what to do. Has anybody
faced similar problem. Can anybody help me with it.

Expecting a positive reply,

Regards,
SV

[devils casper]

I have never faced such problem but it looks like problem is with PenDrive only. Try wiping Pen Drive using 'dd' command.

dd if=/dev/zero of=/dev/sdc bs=521 count=1

Be careful while executing 'dd'. Make sure to type correct device name.

[svzard]

Hi Casper,
I tried the 'dd' command (with correct drive letter). But after that the
pendrive is NOT mounting at all... forget about the repeated auto-remounting...


I tried the mount command but it failed to mount. Below is
what I got for dmesg:

SV-Debian:/media# df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sda3             10317860   7079232   2714508  73% /
tmpfs                   485684         0    485684   0% /lib/init/rw
udev                     10240        84     10156   1% /dev
tmpfs                   485684         0    485684   0% /dev/shm
/dev/sda5             10472104   8251104   2221000  79% /mnt/datashare
/dev/sda7             20962544  20357200    605344  98% /mnt/media
/dev/sda9             15480800   5741084   8953336  40% /mnt/personal

SV-Debian:/media# mount -t vfat /dev/sdb1 /mnt/pd
mount: wrong fs type, bad option, bad superblock on /dev/sdb1,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

SV-Debian:/media# dmesg | tail
sdb: assuming drive cache: write through
SCSI device sdb: 8028158 512-byte hdwr sectors (4110 MB)
sdb: Write Protect is off
sdb: Mode Sense: 03 00 00 00
sdb: assuming drive cache: write through
 sdb: sdb1
sd 23:0:0:0: Attached scsi removable disk sdb
usb-storage: device scan complete
FAT: bogus number of reserved sectors
VFS: Can't find a valid FAT filesystem on dev sdb1.

Can you make anything out of it?

And, I saw my modem 'reboot' immediately after the 'dd' command.
It was not the occassional disconnect. It rebooted completely.
Now, I don't know if it is related or just a co-incidence.

Now, when I log-into windows it gets auto-mounted repeatedly!
I scanned it with Avast Home edition. It does not find any
traces of virus in the pen drive. I also formatted it several
times but its of no use.

Now, I had connected my good drive and after I unmounted it and
connected the bad drive, the mount point of the good drive is still visible
in /media!!! Even with the (good) drive unmounted and disconnected from
the system, I'm able to cd into it! Here is what I saw:

SV-Debian:/media# ls
cdrom  cdrom0  floppy  floppy0  SAI VINOBA
SV-Debian:/media# rmdir SAI*
rmdir: SAI VINOBA: Directory not empty
SV-Debian:/media# ls -la SAI*
total 8
drwxr-xr-x 2 root root 4096 2008-04-13 11:28 .
drwxr-xr-x 5 root root 4096 2008-04-13 13:51 ..
-rw------- 1 root root    0 2008-04-13 11:28 .created_by_pmount
SV-Debian:/media# file ./SAI*/.creat*
./SAI VINOBA/.created_by_pmount: empty
SV-Debian:/media#

Do you make anything out of it?

[bigtomrodney]

Well dd was being used to wipe the drive, you will need to format it again now before it can be mounted. Try using gparted if you can.

[svzard]

hi 'big' brother,

I tried that too. I did 'dd' as 'casper' told with correct drive letter for my thumbdrive and
then used gparted (coz, in debian i was not able to find the format command, even while
in root account!) to formated it. Now, strangely though the repeated automounting in
linux has stopped but it is continuing under windows!

One senior in one of the other forums suggested to check if 'FUSE' is enabled in my set-up
of Debian. How to check if it is enabled? If that is enabled can that be a cause of this
behaviour? In that case isn't it a bad idea from security point of view to enable FUSE by
default, coz I did not enable it...

[bigtomrodney]

I wouldn't be worried about FUSE at the moment, if it's continuing in Windows after a reformat this would point to my first gues when I read this thread which is that the USB drive is faulty.

It could be anything froma faulty controller chip to a bad connection on the jack. I have seen drives becoming hit and miss after being bent slightly or submitted to pressure. Does this sound likely to you?

[svzard]

Update to my earlier post...It still automounts repeatedly in Debian albeit not at the rate it remounts in Windows.

Well, I'm little rough in handling devices...but infact the affected drive
is of my friend. Don't know how he has handled it. After he gave it
to me to check I might have plugged it in and taken out roughly.

But, seriously does that matter so much? In that case what can be
done now?

[subrat]

Hi all friend. I am using linux Fedora version.
while formating my pendrive using command #/sbin/mkdosfs -F32 -I /dev/sda , I formatted my pendrive. But I also used both sda and sda1. After this, my system is not booting and asking to insert some bootable cd.

What should I do and can i recover my data. I was having both windows xp with 120GB partition and linux Fedora with 40GB partition.
Please guide me.

[svzard]

Hi subrat,
If you have a harddisk connected the usual way and you connect a pendrive, its usually /dev/sda for harddisk and /dev/sdb for the pendrive or any other drives. sda1, sda2... or sdb1, sdb2...etc denote the partitions on those physical drives.

I'm afraid you have erased your harddisk and all your data has gone and the only option you have is to reinstall both windows xp and linux. I would love to be wrong though...

You should always excise extreme caution when using commands like format, dd etc. Even if you are an expert user...